Holding data is on ongoing behavior. It isn't an ex post facto law to change how a company handles it in the future. Coca-Cola can't sell you a soda with coca

Holding data is on ongoing behavior. It isn't an ex post facto law to change how a company handles it in the future. Coca-Cola can't sell you a soda with cocaine in it just because it was legal when they started their business. What would make it an ex post facto law is if companies were punished for how they handled data before the law was created. It is perfectly reasonable to punish them if they continue that same behavior after the law was created.