I always wonder about what do service providers do when the person who's data you've collected is a bad actor such as someone abusing the service, committing cr

I always wonder about what do service providers do when the person who's data you've collected is a bad actor such as someone abusing the service, committing credit card fraud or running a bot network? They too can just submit a request on all your fraud data and have it deleted? And if the answer is "well in those cases you can make an exception" well where is the line drawn, and how?