In Finland, an online retailer was fined €856,000 for violating data protection laws. They required customers to register accounts to make purchases and failed to define a storage period for collected personal data, resulting in indefinite retention. The lesson: Controllers must define clear data storage periods independently, not leaving it to customers, and cannot mandate account creation for purchases.