When a law requires data to be retained for X time, risk-averse companies interpret this as an instruction to immediately delete said data as soon as time X passes, and use automated tools to this end. Sadly, these tools tend to be ad-hoc software written and maintained by internal teams, and thus about as buggy as you'd expect.

I've worked in such places, and - in addition to all the other issues - the continuous collective loss of corporate knowledge makes life pretty miserable.

But, it is unfortunately absolutely realistic that companies are throwing away data the moment they can justify it. Ironically, it’s not the ones we’d like to forget about us most.

Data retention is a liability as much as it is an asset, and it’s challenging regardless.

If you’re a large enough company you will eventually come to be frustrated by whatever policies you have (either they’re too conservative or too liberal). And understandably when you’ve been caught being shady enough, even an honest deletion will look shady.