Just because you've forgotten about a company doesn't mean that a company has forgotten about you—or your data.

While emerging laws such as the European Union's General Data Protection Regulation (GDPR) or the California Consumer Privacy Act of 2018 may be granting consumers more control over how their personal information is collected and used by businesses, those powers aren't automatically triggered by the termination of a subscription or service agreement.

According to Kirk Nahra, a partner specializing in privacy and information security litigation and counseling at Wiley Rein, privacy laws and the lifecycle of commercial relationships continue to run on parallel tracks.

“There's cancelling the subscription, which is a financial transaction. The data point is an entirely different point, and historically 100 percent of the time and currently still most of the time, cancelling a subscription says nothing about your data at all,” Nahra said.

Earlier this month, the struggling ticket service MoviePass sent an email to costumers whose subscriptions had been “suspended due to inaction.” The email said that those subscriptions would be restored unless the users “opted out.” Failing that, the credit card already on file with the account would be charged $9.95 a month.

MoviePass' approach isn't so dissimilar from the type of automatic renewal someone who subscribes to a magazine or a newspaper might encounter. If a customer who failed to heed the “opt out” email decided to pursue legal action, it wouldn't be on the basis of the credit card number or any other personal information kept on file after the subscription had lapsed.

“I think most of this stuff is not really a privacy issue. It's going to be a contract issue,” Nahra said.

Consumers can request that their commitment to an online publication or service be terminated, but the dilution of that relationship does not require the company to delete or cease sharing the information associated with that account to third parties.

In some cases, it's a practical consideration. Everybody who's ever cancelled a magazine subscription has probably received a postcard or two asking them to consider picking things up where they left off or jump immediately into a new commitment without the hassle of having to fill a new set of forms.

“They're not only going to try and get you back, but they are going to continue to try and sell your information to somebody else. … That's a reason why these new privacy-related laws are on top of whatever the commercial relationship is. [But] you can now ask, if the magazine company is in France, you can now ask them to remove your data,” Nahra said.

Subjects living under the EU's GDPR have the “Right to be Forgotten”—the ability to request that a company erase and cease dissemination of their personal data—but even that exists separately to the act of cancelling or opting out of a service. The same would apply to the California Consumer Privacy Act of 2018 when it goes into effect in January 2020.

“There may be conditions on it, but generally you can always stop the payment. That has nothing whatsoever on it's own to do with what happens to your data. There's no principal,” Nahra said.