Mishandling private information, such as customer passwords or social security numbers, can compromise user privacy and is often illegal.