What I got from your quote is that he thinks it's not possible to control how data is processed after it has been received -- he's not talking about the entire

What I got from your quote is that he thinks it's not possible to control how data is processed after it has been received -- he's not talking about the entire process. Since the data is on somebody's server, there's nothing that can be done to stop them from making poor decisions with it (such as storing CC numbers in plain text).