Online retailers continually need to worry about identity theft-based purchases and now, as they hold a lot of personally identifiable information, GDPR fines.