Comment Re:Lovely (Score 5, Interesting) 172
It might actually be illegal. In a nutshell, the Privacy Act requires that all personal information must be kept appropriately secure. If a company sends personal information to a third party, it requires the company to ensure that they keep the information secure too (e.g. by having a clause in the contract requiring them to meet the requirements of the Privacy Act). It is not possible to provide personal information to a USA company and still meet the requirements of the Privacy Act, because the USA's Patriot Act allows the US government to gain access to that information (without even informing the information owner).