If they're allowed to keep that data, then that needs to be addressed immediately. It'd be all kinds of fucked up.

Don't worry, they probably use a third party to have this that says it deleted the data, doesn't, and will be hacked within a year.

Wait, no. Do worry.