There's absolutely more than zero risk. In Denmark a medium sized taxi company was fined $200,000 for keeping their customer data longer than necessary.
Also: How are Google and Facebook offenders of GDPR?
Also: How are Google and Facebook offenders of GDPR?