Access logs for one thing are pretty unreasonable to force people to avoid storing.
>Existing systems were built on the assumption that "misappropriating" PII was a lucrative thing to do. This led to abuse from the industry.
Can you point out a specific example of somebody suffering actual damages from this "abuse?"
I think it is certainly possible to find cases of identity theft resulting from PII that were leaked in security breaches, made easier by overreaching data collection.
Store them for a limited time, it's not hard.
Sometimes it's important to update regulations, despite the inertia of existing implementations.
As the first offense only seems to result in a warning, they have a chance to figure things out. Then is asking their webdev to schedule a cron job to delete logs really such a burden?
It is not difficult to avoid storing data you don't need.
You don't need a user phone number? Easy, don't ask for it.
Of course you argument is that it is difficult to change existing systems to follow this principle. Except that your starting position was that this regulation was about stifling competition, which is thus in direct contradition with this argument.
Existing systems were built on the assumption that "misappropriating" PII was a lucrative thing to do. This led to abuse from the industry.