[hhenn]

Who makes the decision about data retention in these cases? Do they plan with breaches in mind? Can anyone who works in that position shed some light on this?

Last spring I received a notice in the mail from a university I had been accepted to four years ago, but did not attend, that my personal information was exposed in a data breach just like this one. The free year of credit monitoring isn't comforting. Why on earth is sensitive information like that kept? The likelihood of people being affected just goes up.