It is very hard to make people understand that scale matters when deciding how sensitive data is. They only ever care about it in whatever narrowly defined use

It is very hard to make people understand that scale matters when deciding how sensitive data is. They only ever care about it in whatever narrowly defined use case they're worried about. The idea that someone can take an element of not-particularly-sensitive data from you, combine it with elements of not-particularly-sensitive data from elsewhere, and end up with a database full of extremely sensitive data simply does not click.