>No one would collect data, and not care about its basic security?

Um...

I think that's exactly what most small organizations do.