At least the US laws I've looked at have all specifically mandated that data shall not be retained, some with rather steep penalties for retention (IIRC ~$10k/affected user).