> Most institutions (especially financial) have strict document retention policies to protect themselves from situations like this. It's not shady – just a way of limiting liability.

Yup. With every data breach, HN is full of (correct, imo) comments about how tech companies should treat private data as a liability and prune it aggressively.

You go look at mature businesses and you'll find that they do exactly this.