I have always advocated that if a company has your PII, it should notify you annually:

1. What personal data they possess
2. To whom they have shared/sold/provide that data to
3. If they have lost or exposed that data (ex. breach)
4. When they will remove/delete the data
5. Provide a 1-click option to delete the data

In this way, consumers can track what data is out there and who has it!