Thanks for the comment. Indeed, it may be exactly that: “IT security” knows regulations (by now) but still does not know business hence cannot consider data valuation (frankly, often neither does the business :-)). Hence regulated data is more protected… and checkbox wins over possibly real risks.
Originally published at Medium.
