This article here serves as a good reminder for plan sponsors to review their service provider agreements and make sure they include provisions that insure providers are doing everything they can to protect the personal data of participants.
(Hat Tip: TheCorporateCounsel.net Blog)