Except that it runs counter to the rules that enforce record deletion.
Right now the path companies need to tread on is already razor thin: Companies are already feeling the heat from both sides.
Customers already sue because right after account deletion their personal data still exists in backups and database tombstones — while on the other hand, others sue for not being able to resurrect accounts with years of data after their accounts got hacked.
There are no winners here. Long term archival as a lesser concern is one of the major losers in this confict.
That means someone needs to go through everything and decide what is sensitive and not sensitive, both from a business perspective and with respect to privacy laws.
I recently went through a bunch of older board meeting minutes and related materials from a non-profit because we were considering donating it to an archive. I scanned a few things but basically decided there was too much potentially sensitive stuff. Yeah, it was old but just too much dirty laundry that someone could take out of context that it wasn't worth the scrubbing.
