Cook isn't arguing that companies should not be allowed to have access to data. He's arguing that there should be laws in place to prevent misuse and abuses of that data.

There's nothing inherently wrong with agreeing to give a company access to your data. But it's absolutely wrong that once you've handed your data over, that company can do whatever it wants with it, with no restrictions, as if they own it.