You collect user data for the purpose of offering a service or selling products through a website. Depending on the nature of the business the range of info collected can span a wide range:
Name, email, driver's license, social security number, credit cards, bank account/s, address, phones, etc. In other words, personal and financial data.
A year later a user decides to close the account.
What laws do we have in the US regulating what information can be kept in a database, in what form and for how long after an account is closed?
Or perhaps, more generally, regulating a request from a user for the deletion of said information?
https://www.state.gov/privacy/
https://www.schneier.com/blog/archives/2006/04/identitytheft...
https://www.schneier.com/blog/archives/2016/07/anonymization...
https://www.pcisecuritystandards.org/
https://www.eff.org/deeplinks/2016/10/empty-promises-privacy...