How much restitution am I entitled to for an ambiguous violation of an amorphous concept like privacy? And how much is Facebook entitled to from a partner who (might have) violated that agreement, causing non-measurable harm to me?
This is getting a little conspiratorial: contracts are very real, and though I didn't see ours and was not privy to any special user data we might have received, we are very careful about that kind of stuff and liability is a huge, huge deal.
A contract stipulating that data has to be protected in a certain manner is a reasonable protection, depending on the sensitivity of the data.
It's very strange that you'd throw your hands up and say, 'well FACEBOOK didn't do it so you're out of luck.' Facebook did do it by not regulating there third party agreements.
Breach of contract opens you up to civil liability. Having this agreement creates disincentives that wouldn't otherwise exist.
"Prevent" doesn't mean to make something physically impossible or remove the ability to choose. Police can prevent drunken driving by announcing they will have DUI checkpoints on New Year's Eve. It doesn't make it physically impossible to drink and drive, but if people choose not to because they want to avoid the consequences, some drunk driving has been prevented.