In my country (NZ), it is my data. It's the literal law that any agent that collects personal information needs to follow a number of rules. (Search for NZ privacy Act for the gory details).

I'm allowed access to the information, and can request that it be updated. They can't keep the information longer then is necessary, they can't use it for anything other than the original collection purposes, they have to take reasonable measures to secure it, they can't disclose it etc.

I won't harp on about the details, but it's relatively well thought out (apart from some limitations regarding the reporting of breaches, but there are changes in the pipeline to patch that up).

That may be the case in the US, but here in Germany I could sue you if you made that picture public. Here people have the right to decide whether pictures of them can be made public or not (with some exceptions).

What about health data ? Children school info ? Company trades in email ? Do you really want to play that card ?