I understand the banking requirements but in theory they should only be keeping certain information for security practices and scrubbing it from everywhere else

I understand the banking requirements but in theory they should only be keeping certain information for security practices and scrubbing it from everywhere else (e.g. marketing/analytics etc)