I've worked for companies who were more careless with even more private data required by law to be encrypted but wasn't .

Always comes down to "we don't have enough time". Then when it leaks we have all the time in the world.