Keystone attributed the retention of exposed customer data to a failure in its automated bulk-erasure tool, which failed to execute data deletion beyond its 180-day retention policy