As others have said, the information wasn't something they'd need (arguably) to vet people, and even if it was, what is the argument to keeping all those people

As others have said, the information wasn't something they'd need (arguably) to vet people, and even if it was, what is the argument to keeping all those people's personal data for more than a decade... They breached the confidentiality expected, and I'm not sure this can be just considered an "understandable mistake"... sorry, they need to be help to the same standards anyone possessing or processing data does.