If they aren’t cooperating with recovering access to your accounts, report them to the CFPB. They are legally required to give a real response instead of a form letter. I assume it costs them time and money, which is a side benefit.
If the federal government requires 7 years, they probably will not budge on that at all. They should have a strong incentive to not leak that data, but they don’t. That is a failing of the US government. We need a HIPAA but covering any personal data instead of only health.
But it seems like there are other easy distros with lenient requirements that don’t try to force Snaps and ads on their users.