Actually that is not true. When companies do it, laws can be passed to stop such behaviour but when government does it, you have to change governance which is more difficult. Also commercial entities cannot siphon people's data under the title of security.