I know of a local company that collected personal data for marketing including SSNs and there is no care given to how the data is stored. Most if not all of it was stored in plain text. You might have more faith in regulatory systems than you should.