“If we start - premise that the information is mine, and we give the individual's rights, we worry about what happens during a breach. If you try to protect access to it, as opposed to not even making it available, you have less to worry about who will break the wall.”