“Uncontrolled access to data, with no audit trail of activity and no oversight would be going too far. This applies to both commercial and government use of data about people.”