Comment by samsquire

Companies should not need to store data. They would instead make a connection to your data custodian or even your own machine and then use a 'personal data api' to fetch only the data they need.

That way you know what was given out and when and it's always up to date. They wouldn't be allowed to store it either. ( https://github.com/samsquire/ideas#92-personal-data-api )