Many companies are purging data associated with inactive accounts as part of data minimization. If the user specifically asked for indefinite retention before going inactive, that might be one thing, but as a general practice it could be risky.