Nick Szabo  🔑

I think a reasonable person would expect information to not be shared other than as disclosed a-priori, and as required to conduct business. And for external access: for reasonable efforts to screen requests for legal authority and rationale for access.

They are legally required to collect it because they are legally required *to* share it. If they didn't have to share it there would be no point in collecting it, it's a huge hassle and liability for all concerned.

Once they have collected the legally required info it's very useful or them, and extremely easy (indeed hard to avoid) to share it with their contractors, who share it in turn, etc., and it's soon out of control, regardless of what money changed hands.

The legalities don't matter all that much. The laws of nature, which make copying data trivially easy and very useful, and generally impossible for a court to undo, are more important than the laws of people.