I suspect it's the combination of the defensive medicine effect (if something does go wrong, no one wants to be the one to take responsibility for having said no to a system that someone else will argue (true or not) that that system could have stopped the event), the belief that the security theater aspect makes customers feel safer, the belief that more data and whiz-bang technology is always better, and the decision makers don't have the technical expertise to understand that it is not getting them much in terms of increased security, and they can always make some money on the side by selling the data that they collect.