If this happened to, say, a credit car company, it would be consider a privacy breech… how the hell is this being allowed?