You pulled that statement out of context, which is that the site may be doing something that is perfectly acceptable, but with the addition of legislation, the

You pulled that statement out of context, which is that the site may be doing something that is perfectly acceptable, but with the addition of legislation, the claim is now much more serious and requires legal consideration. This is particularly troublesome if the request is made in bad faith, which is a great way to "DDoS" a company/individual. Why, in the case of a single individual running a website, is it suddenly their responsibility to properly manage someone else's PII? Where is the responsibility on the individual whose PII it is? How did the PII get there in the first place? Surely it should be considered negligent to hand out PII to a company whose business model is transparently selling user data.