When “Compliant” Still Means Exposed: Rethinking Customer Data Risk in CX