Why are they even keeping years of call records? This strikes me as something that should be deleted after the current billing cycle (plus a delay for complaints, say 12 months). This kind of just-in-case or I-don't-want-to-push-the-button retention of data should hopefully be given some disincentives by GDPR but there is still a hell of a lot too much of it going on. Storage is cheap doesn't mean keep everything forever, especially potentially sensitive personal data.