I Canada we have this thing called PIPEDA (http://www.privcom.gc.ca/legislation/02_06_01_01_ e.asp) which is designed to prevent these sorts of things, and carries fines up to $100,000 (which I don't think is enough to convince some companies to care)