Yep, now if you have N friends your data might be in the hands of N companies. You'd need a GDPR-like privacy framework with audits and even then the risk of mistakes is enormous.

(Note that when people talk about data portability they're really talking about federation since social networking can't work otherwise. Non-social data is a little easier.)