I would be very interested to know if this is in use outside the US (specifically, inside the EU).

Looks like a serious breach of data protection directives:

http://en.wikipedia.org/wiki/Data_Protection_Directive

Personally identifiable, highly personal information gathered by a third party without permission, let alone notification.