Indeed. I have many times mentioned this with business/product owners in my organization - but it is a nasty mix of complicated laws and regulation, pressure from legal, and a mentality of risk-minimizing. I usually only mention it in passing because fighting the requirement (which often is not actually needed) would take all my time and several weeks/months. I dont really care in the end.