You would think some sort of data protection would be part of the company policy when handling such sensitive information, wouldn't you?