More than that but there's no regulatory push (outside of maybe healthcare?) to require stringent handling of peoples data. If anything the opposite is true where the government wants people to build a specific backdoor for them.

This is certainly one of the reasons I've become more aware recently of the amount of data certain companies have on me. Data breaches have the potential to be catastrophic and very few people are looking out for my best interests.