Your point is valid; however, I would say that something being legally possible and technically possible are two different things. I think there have been sever

Your point is valid; however, I would say that something being legally possible and technically possible are two different things. I think there have been several data breaches in the past couple years that have shown data to be kept or used beyond its assumed intended purpose. Even if the company itself followed the law completely, there's nothing technically stopping a bad actor (internal or external) from doing whatever they want with it if they access it.