Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out.
Paraphrased:
Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine.
Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it.
You can't make private contact information public without consent.
However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request.