Don't forget that other manufacturers collect the same data, they just didn't have a collection of blunders that allowed access. No malicious intent this time, but it clearly highlights that companies need to learn to put policies in place to make double sure PII is actually protected to the degree the law already requires. We also need laws that force companies to make opting out of this kind of data collection much easier, or to make it opt-in in the first place.