It's a great question, with all the data that people willingly share online now, there's little thought to what happens to it if it's not cared for/looked after. What is the companies legal obligation once they no longer have a need for the data? Do they destroy it? Who checks on this? Or do they simply drop it into an xls spreadsheet and auction it off to a spam house...