Didn’t that id verification service that just had the massive breach also say similar about data retention? Doesn’t matter if they delete if the data is being intercepted somewhere along the line.