"never attribute to malice what can be explained by ignorance" This is a US based org so they probably have no idea what they are doing around PII data other t

"never attribute to malice what can be explained by ignorance" This is a US based org so they probably have no idea what they are doing around PII data other than what's required by US law and even then.