They probably don't, but it's still a good protection if you treat it as a more limited one. If you assume:
[ ] Don't use
Doesn't mean "don't use," but "don't get caught," it still limits a lot of types of uses and sharing (any with externalities sufficient they might get caught). For example, if personal data was being sold by a data broker and being used by hedge funds to trade, there would be a pretty solid legal case.
