I say make any company collecting info (beyond maybe some very bare-bones basics that any company providing a service pretty much has to have, like name, address, phone number) about its users provide that info, say, once a year, on request. Kinda like the annual free credit reports from the credit agencies.
ALL of it, too. Every time. Not just what was collected since last report. Even require that they provide it on physical media if desired. Again, for free, including postage.
"But that will be so expensive because we collect so much and never get rid of any!"
... yeah, so what?
Now they're free to do it but can't hide what they're collecting and can't hold your data hostage. And there's some cost associated with collecting more than is absolutely necessary.
