But it does create an incentive to not keep data that a company doesn't really need. And that incentive already works with GDPR for PII.

This measure add similar incentive for data breaches.