Starting a database with personal information on a large amount of personae. Without them knowing about it. Refusing to share the gathered information. All of this is legal in the US? In the EU???