The problem I have is that you are conflating potential damage and actual damage as the same thing, which is not how you accurately measure risk.

I am honestly confused as to how you interpreted my last comment as "utterly cavalier about the prospect of ruining people's lives", when all I said was that your assumption doesn't take into account the actual probability of data being leaked and it doesn't weigh any of the benefits of data collection against that risk.