Anyone and anybody. If the data exists, the data can be (ab)used. Microsoft getting hacked by hackers to find out how much they knew about the hackers is the case in point. This is why "surveillance by design" and backdooring things is a terrible idea, because we need less data collection, and we need more security, not less.