The latest Facebook "scandal" is a huge lesson in how companies can be liable for third-party uses of their consumers data, even if that data us and collection was a breach of that company's privacy policy... Having a privacy policy is a first step, but true enforcement of that policy is what shields you from liability.