Agree - your comment makes me think of a tweet[1] I read recently:
"If you're collecting personal data, 'how should I protect this?' is actually your third question.
'Should I collect this?' is only the second question.
The first question is 'what would the worst people do if they got hold of this?'"