I just read the 1998 Data Protection Act, and it is very similar to dozens of laws that govern data privacy in the US. There are 8 specific directives in the l

I just read the 1998 Data Protection Act, and it is very similar to dozens of laws that govern data privacy in the US. There are 8 specific directives in the law. #1-6 are about consent, #7 is about security, and #8 is about correcting inaccuracies. So again, if a website owner clearly informs the end-user about their policies, and the end-user agrees then, the website owner is in compliance with law. The specific example that motivated my point -- "you can't keep people's data around forever" -- is simply not true in the US or in the UK (if the '98 DPA is the only applicable law; there may be others I'm not aware of).