My experience is that, beyond some size threshold, people tend to stop caring about generic company policies because they don't understand them (nor they are well communicated or explained, since there is a large gap between management and employees) and just do whatever is handy to them. At the same time, management stop thinking that trust works as a way to enforce policies and start enforcing them technically.

Financial services companies have legal obligations to cntroll the ways their information is managed. Even in other industries there are some kinds if information for which legal restrictions and responsibilities apply to their storage and dissemination.