I'm not sure it is. I think it's the same principle that things like GDPR are based on. It's not that you want to prevent the entity from having access to that data at all. It's that you don't want that data sitting around forever which becomes a security liability where the attacker is not the recipient of the message.