Uber really needs to have a public data retention policy stating that they anonymize or delete all data older than a couple weeks. I'm just waiting for them to be hacked and have to reveal that people's trip data for years has been released.
Starting with the user story: "As a Pawn Shop Clerk, I scan a copy of the customer’s drivers’ license because the company is required by law to keep this record at least two years from the date we purchase a used valuable from a customer."
https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s
There was a good Q&A about data retention, that included a lawyer in the audience.
Obama's proposing data privacy regulations. I think it's worth considering what you'd like to see involved in same.