Best metaphor I've heard is that personal data should be treated like toxic waste. If you're a company that works with it, it should only be because you have to, not because you want to. And then, you want to keep as little of it around as possible. You definitely don't want to leak it, because then the EPA will come down on you like a ton of bricks. All of your processes should be geared toward minimizing or eliminating exposure to it whenever possible.

Unfortunately, companies are incentivized to treat personal data like something to be aggressively gathered and hoarded instead... but not necessarily like something to be guarded against leakage.