“Even if they promise to use your private data for internal or security reasons only, you have to expect that this data may become public in one way or the other.”