Next year new data-protection EU-law will be introduced, it will hit companies like Facebook, Google and MS, it will also affect your company, so take a read what's changing http://www.telegraph.co.uk/connect/small-business/business-n...
GDPR is huge and #1 on just about every priority list. Accounting for every single piece of (even theoretically) personally identifiable information, access restrictions to said data, storage time limits, logging of access and changes (without logging anything sensitive) and everything else is a gigantic undertaking.
Every single system we have that stores or even just caches data is affected by this, and it's tying up a large amount of our resources.
As a consumer I certainly welcome the GDPR, but as someone who works in IT, holy shit our workloads have increased.
Finally there might be a drawback to just collect just because it seems to be valuable and might be exploitable tomorrow. The vast majority of companies never even recovers the development cost of collecting the data, no wonder they don't have the energy left to secure it.
I don't know what kind of nasty data the marketing department keeps, I'm only looking at the engine room :-)
But no--we just let them do as they wish.
(I don't blame anyone. Just making rent here seems like the last straw. Not the best/greatest anymore?)