Trying to avoid the "anonymous/no longer than necessary" "loophole"

[hugoroy]

https://twitter.com/CasparBowden/status/533203844734664704

Data received, generated, and/or collected from users’ activity while using the service (e.g. metadata or social graph data) should be made accessible to them and put under their control as well. If this control can’t be given, then this type of data should be anonymous or not stored for periods longer than necessary.

Can we actually come up with examples where this control can't be given? cc @karlitschek