Most jurisdictions allow businesses to collect, use, share, or sell data about you without notifying you that they're doing so. There is no uniform national policy on when (or if) a firm must notify you if your data is stolen or accessed by unauthorized people.