They cross-reference publicly available data.
In Europe it is illegal, we should adopt the same security for individuals.