In Europe, if I understand EU data privacy laws, all three of those CRAs would need my permission to retain my personal information. Maybe not explicitly grant

In Europe, if I understand EU data privacy laws, all three of those CRAs would need my permission to retain my personal information. Maybe not explicitly granted by me directly and personally, but absolutely revokable by me, both directly and personally. In the USA, ... it is what it is. I can't revoke those grants, individually or summarily.