I'm not sure why this is downvoted - it's a little bit counter to the scope of the parent article, which applies to all sorts of design decisions, not just data retention and usage, but I would agree that this /is/ the base level of control over any data that a third party has from me and should be enshrined in law.

It has been great to see Apple, for example, move more towards better awareness and defaults for C, but by and large the internet is still a mess of hostile defaults, opaque privacy statements, and no way to know that this weather app is selling your location to advertisers when they could've just asked you for your location, if they wanted to be a weather app.