The ethics of data retention haven't been fully fleshed out, but it seems pretty obvious that the industry has to start deleting data at some point because user that lives forever is guaranteed to one day be compromised or exploited.

It also seems obvious that voluntarily deleting data is unlikely because data is an asset. Regulation seems unlikely to be forthcoming because governments want their own access to corporate data to persist.

What's not obvious is how to approach the issue.