^ What privacy statements SAY and what legal teeth are behind thier following or not following them are two different things.
I used to work for a company that had the usual, expected privacy statement/policy, but contrary to it, openly sold marketing lists to anyone with a checkbook.
Who is really going to sue and win, thus proving an information breach by a singe company. The whole privacy statement fad is worthless.