Certain data records need to be legally retained for certain amounts of time; Other sensitive data (e.g. PII) have security requirements. Why wouldn't governme

Certain data records need to be legally retained for certain amounts of time; Other sensitive data (e.g. PII) have security requirements. Why wouldn't government mandate storage requirements given the above?