For one thing you are wrong to assume they are completely legal. Big companies with big legal departments regularly make mistakes... its human nature, but I think with big businesses the problem is exaggerated by the implicit assumption that they must be legal if they are big.

Now the fact that they collect this data and people voluntarily agree to it is precisely the evil part. People agree without realising what they are agreeing to. There is a more general problem here which isn't Facebook though - its that EULAs and fine print are given legal weight when nobody reads them and this is common knowledge.

Now... to tie this altogether I never realised Facebook would store my deleted messages that might have been in the agreement I "made" with them when I ticked that check box and pressed okay years ago. Now, flagging for deletion is fine, in their case though it costs them expensive storage space - maybe its cheaper than the processor time to delete things - either way its irrelevant because they shouldn't do this because the Data Protection Act says that information should be kept for no longer than is necessary.

I don't know if they have any need to comply with UK/EU law to allow accounts for people who live here - I don't think they do, but I would hope US law has something similar...