Office buildings and government buildings have surveillance set up. Online, it's pretty easy pickings. A lot of servers aren't secure, and it's not like you have to be super-sophisticated to learn how to hack into the site. You get a lot of bang for the buck.
You only have to see one privacy policy to realize it doesn't have a lot of teeth to it. People are discouraged to learn that retailer privacy policies don't protect their privacy. They just tell you how the retailer will use the information.