They are holding the data based on your express consent for them to hold the data (hence the requirement for you to press "YES").
Even if the HP were to be holding your data illegally, it is rare for you to be able to extract civil penalties. Normally this is because they are holding data against you that is held illegally (e.g. was hacked), is inaccurate or being used for defamatory purposes (e.g. your photo is being used to advertise adult services).