> The “corporate brand functions” (i.e. marketing, PR, legal) value privacy issues over speed. My poor friend is stuck in the middle.

Marketing dept. is most probably the worst offender of online privacy.