I know there is for example a Data Protection Act in place in the UK which, if I understand it correctly (IANAL), states that an organization cannot keep your personal data for longer than 6 moths (which is why my Blockbusters card expired and some headhunters keep calling me every 6 months just to keep my account alive). Is this the kind of thing you have in mind?