Great post by @ehasbrouck on the hacking of admissions records from Columbia:

"The best way to avoid misuse of personal data is not to collect it. If it has been collected, and especially if it is no longer needed for the purpose for which it was collected, the best way to mitigate the risk to the individuals to whom it pertains is to expunge it."

https://papersplease.org/wp/2025/07/08/the-dangers-of-identity-databases/

Also that EU/Canadian privacy laws mandate deletion - a clear example where the US is behind and the harms that follow.