Worst case scenario is that the stored info is taken by someone more malicious and used for anything unintended beyond the original purpose.

The whole point of "less surveillance" is to limit the amount of information stored, because information stored IS the vulnerability.