If they only kept the data that was necessary for legal compliance with tax regulations, they wouldn't have been fined. That's explicitly allowed. That they were fined suggests they just kept everything, far beyond what they had to keep.