All I have to say is that it shouldn't just be a process to wipe data, but it should be that if you don't wipe data, and it includes data about people who are not yourself, that selling it without wiping it should be considered a criminal act of negligence.
Of course the US couldn't give one shit about that. Our privacy laws are fucking bullshit.