Well, they should not be permanently maintaining data - at least in the UK, and I'm sure in many other countries.
Principle 5 states:
Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
If they are keeping data permanently regarding UK citizens then they are in breach of UK Data Protection Law.
I would expect the same will also apply in most developed countries.