Formulating proper data destruction policies to reduce data breach risks