I think there also needs to be a law that, once you have accepted responsibility for storing someone else's data, that you can't delete it "on a whim" without offering some minimum retention period ok your data. As an example: a storage facility is allowed to stop doing business with me, but they legally can't just destroy all my stuff on a moment's notice... we have laws for minimum retention periods.