yeah, we need to make this kind of data harvesting 100% illegal, and then, tada, no catch 22 to deal with! it’s a non-sequitur to negotiate how much data can be collected and stored by random third parties. the answer should be an unequivocal “none”. then as a nice byproduct, we wouldn’t have stupid equifax mass data leaks every other month.