I am more pessimistic. When discussions of securing user data come up, how often do people vote - limit lifetime of collected data and delete it after x days? I

I am more pessimistic. When discussions of securing user data come up, how often do people vote - limit lifetime of collected data and delete it after x days? I don’t think businesses ever choose that because they don’t want to commit to the lost opportunity to mine that data later. So what we are stuck with is security through some ad hoc set of encryption and distribution practices- ie only let the transcribers have random access to a small set of data. But then years later we discover the whole dataset is hacked, leaked or accidentally publically accessible and the only thing that would have guaranteed to protect us was - systematically deleting data, the thing they will never do.