It seems like they were able to get the data just fine, so they're not guarding user data now. I think the best way for facebook to protect this data is to not have it.