Yeah, do people really want no supervision on employees handling their PII or other sensitive info? I think I would be upset if I found out my info was not even being attempted to be protected while in an employees possession.
They take a bigger cut then most other digital store fronts and they have a history of using the loyalty of fans to do unpaid work such as translations and perform the majority of moderation on Steam.