None of those cases other than the pci scoped one were covered by regulations at the time. They are just experiences I’ve had where I got data I didn’t want and didn’t ask for and had to make the decision on if building a capability to read/detect it systematically for deletion was a better privacy control than not.

I have had similar cases covered by GDPR as well of course but my broader point is that the idea that you only get the data you ask for doesn’t align with my lived experience.