What are their legal obligations to protect this data and not share or sell it to anyone?