What I don't understand is why they need to (or should be allowed to) retain that data in perpetuity.

Probably because there is no law saying you need to delete the data in X days.