They can totally delete "their" data. It's not "their" data if someone else has it.