Internal privacy experts worried that not having a corporate records retention policy could violate U.S. and EU laws. Years later, the company still doesn’t have one.| Forbes