If they don't, you have political and legal recourse. A third-party company doesn't have the same legal obligation, nor does the public have any democratic control over that organization. Data companies have institutional pressures to preserve data at all costs, not to be proactive in destroying records of innocent folks.