[soupson]

Asking companies not to retain PII is like asking a crack addict to please ignore the crack pipe and torch while you step out for an hour. The only solution is to make PII radioactive. Tax it. Burn companies that abuse it or leak it to the ground. HIPAA is a fucking nightmare but companies still figure it out:

[Nextgrid]

GDPR is mostly that; the penalties for data breaches are essentially a tax on PII. GDPR also restricts how you can process data and the user should always be informed and has the right to object.

The problem is that the GDPR is not being enforced seriously.