This is why it's very costly and time consuming to construct regulation that actually works. Crafting a set of rules that properly counter a system set up with incentives to do otherwise is pretty tricky.

I feel like it would be better if we could find a way to disincentivize companies from hanging on to your data. Maybe treating it as some kind of taxable asset.