They don't have any particular duty to protect the data they have about you, other than protecting their own IP. They certainly do in much of the civilised wor

They don't have any particular duty to protect the data they have about you, other than protecting their own IP. They certainly do in much of the civilised world. The US is almost as far behind the norm in the modern world when it comes to privacy safeguards as it is in its banking and financial infrastructure.