This is why we need data breach laws -- to which dictated Terms of service's must abide. You can't write in a TOS "we have the right to kill you"... it should be the same way with data -- any changes to the scope of how and to whom data is accessible must be approved.