We may discuss about proper authentication mechanisms here, but I guess the real lesson learned is "don't gather data if you really don't need to".