In regards to:
> It's his company, and he can do what he wants.
In any country, this is of course only true to the extent that he follows the applicable laws. In Europe, these laws are increasingly including provisions about data privacy. Therefore Facebook's attitude towards data privacy is not solely up to him, but also restrained by the democratic process.
How effective this will be remains to be seen, admittedly.