Followed by deleting data once you've used it for its stated purpose.

Personal data needs to be much more of a liability than it currently is for anything to change. Business will respond when the bottom line is affected.