You're right, there is absolutely no guarantee and I don't trust that the data would disappear, and there should be a real price to be paid to the end user for guaranteeing that trust.

But "we don't negotiate with terrorists" isn't very brave if you're giving up someone else's data.