> There should be some consequences for companies […] retaining drivers licence photos after test driving a car, they just don't need the data anymore.

I know it’s modern American tech tradition to make fun of the GDPR, but this is genuinely one of the things it stipulates: You’ll get at least a slap on the wrist, or potentially much worse, if you needlessly keep data around longer than necessary to do the task you had collected it for in the first place.

What punishment does the country of Denmark get here, if you had to guess?

Pretty ironic to be extolling the virtues of the EU's privacy approach on this story in particular...