Maybe (s)he has decent data protection laws in his/her country. I'm pretty sure this would be illegal in the EU, under the Directive 95/46/EC.
To make myself clear, I'm not saying they don't do it. I'm saying it's probably illegal, therefore the fine print doesn't matter.