I'm providing some of those services to some smaller bussines. If I've got information that some user is not longer working for that company, I would delete/remove all the data associated with him same moment. There is few catches about it, but as sooner You remove them, the less chance is to end up with some horny manager asking for mail from cute secretary which was fired. To sum up, I'll go with "right on time" removal of all former employee data, and in case employee still HAS account/data in my system, then customer have any right to see it since they ARE paying for it. I'm not going ethical into these things, I'm selling services...