It's a big loophole. If a company doesn't know who took (the information) or why, they don't have to tell you about it.