I don't think there is any rule or law requiring companies to hard delete customer data. I would bet that most companies never delete based on know your customer, anti-laundering, and other SEC regulations.