There has been a sea change in regulations over the past 5 years and the pace of change is accelerating (thank you Snowden), but few individuals responsible for the collection, storage or processing of sensitive data have any clue about privacy. Most companies rely on their legal counsel but only a small handful of lawyers have a deep enough understanding of technology to properly mitigate risks from misusing data.
People who can fill the gap between the technology and legal issues are truly a rare breed.