It's even worse: On several occasions I didn't sign a contract or an addendum because I had questions about it and the other party didn't even check whether I actually signed it. So, even if you don't sign the agreement there's a good chance that your data is sent anyway because nobody checks for that.

Of course that could be grounds for a litigation, but at that point the data is already gone and, other than being a PITA, suing wouldn't really be worthwhile as that hardly counts as damages.