To your point is the Beverly Dennis v. Metromail case. A company had a bad idea for outsourcing some of the tasks they performed with the data they had.

It's covered here http://www.privacyrights.org/ar/ftc-info_mktpl.htm (buried deep in the page)