Google and Facebook et al stores and processes PII on non-customers, without informed consent given from users.
It's still early days. We'll see what will happen when the DPA's and the courts have fielded a few high profile cases.
This! I hope it costs them dearly. I have never (willingly) given them consent to have my data, yet I know they have loads of it, just because other people I know are careless with data about me.
It literally is:
- you only store data you require to run your business
- you delete data if customer requested deletion
- you give the customer their data if they ask for it
If your profitable business is built upon selling customer data wholesale to third parties, then good riddance.