> If Dropbox sends all data of all users to third parties without telling anyone before the fact, that's another thing If they've ever signed a BAA (business a

> If Dropbox sends all data of all users to third parties without telling anyone before the fact, that's another thing If they've ever signed a BAA (business associate agreement) with any enterprise customers using Dropbox for documents bound by HIPAA, this would get them into a lot of trouble very quickly. The financial penalties are _high and per exposure per employee involved_. They also hit employees doing directly (if you disclose/share HIPAA info then you personally are liable). So I'm certain that even if they did share documents with undisclosed 3rd parties without notice, it wouldn't be "all". Enterprise data is likely safe. Those contracts get heavy scrutiny before signing.