Ask HN: US laws affecting private user data?

You collect user data for the purpose of offering a service or selling products through a website. Depending on the nature of the business the range of info collected can span a wide range:

Name, email, driver's license, social security number, credit cards, bank account/s, address, phones, etc. In other words, personal and financial data.

A year later a user decides to close the account.

What laws do we have in the US regulating what information can be kept in a database, in what form and for how long after an account is closed?

Or perhaps, more generally, regulating a request from a user for the deletion of said information?