A company's compliance officer notices that customer transaction records from twelve years ago are still stored in the active database, even though a regulation requires such records be kept for only seven years. Which data-handling control was most likely not followed?