A company keeps former customers' personal data for ten years after they close their accounts, with no business reason to do so. This best illustrates a problem with data retention — which of the following?