If we're into bad physical analogies, I feel a better comparison would be the company itself sending an indexed copy of the records of all their clients and relying on ethics alone to keep someone from reading others' data.