Under Canadian Law (which you are subject to, according to your profile) and you're liable if you decide to snoop on a specific persons data, or misuse it in a way that they didn't intend. So, it doesn't seem to be completely your information.

> Your laws may say differently

Sure, Canadian laws in this area are very scattered and backwards. I wouldn't put that forward as a good thing though, or use it as a pretense to not bother protecting or managing your users PII.