Just because the information probably won't be damning doesn't mean that the company has no responsibility to keep that information as safe as possible.