Facebook admits its third-party developers have mishandled private data

This is in the headlines a but it seems to be there's more to it than the headline.

I mean, what does "pass" even mean here? As I remember, the UID is what you use to get all the rest of a user's information. How could you not pass it within your application and how is passing the information bad if you already have it.

I'm equally unsure why this a privacy violation. It seems more like a "we want to pretend this info is private even if it's publicly searchable" kind of thing.