CA had access to information they never should've had. Just like phone apps having access to a Contacts API that they never should have that kind of access to.

CA had access to information they never should've had. Just like phone apps having access to a Contacts API that they never should have that kind of access to. Having a tightly managed API would be just fine.