This sounds awfully close to the "why would I care about surveillance, I'm not doing anything wrong" argument. The reason it's important for Facebook to be legally required to protect user data is because you have no choice in being part of that data. You, as an individual, can do quite a bit, but you can't prevent people from sharing their contact books, pictures, and location. With the ubiquity of Facebook, everyone has some sort of footprint on the site.

If the data is valuable and worthy of protection, and you have no ability to provide that protection, then it is reasonable for protection to be required from the layer that is removing the individual's agency.