Back when I was a wee sysadmin helping start a MSP, we had lots of law firms, and I can confirm, despite claims of checks on this, the privacy invading things I saw them do!

Supposedly the checks have actually gotten better, but I'm skeptical.