To actually keep data persistent on IPFS and not be deleted by the garbage collector, you need to have a server(s) pin the node that holds that data.
You either host these servers yourself, or pay providers to store it for you.
And at that point you just reinvented a server simply hosting your data but with extra steps.
Cool but the proper solution is that they shouldn’t have access to this data at all. It should be either stored locally, or encrypted on their servers. Companies not being able to access their consumer data should be the default.