The constraints will depend partly on the law of the country you are in. UK law, for example, has clear limits on how data may be used, held and sent. In particular, there are laws about passing on data to third parties. An organization may also have to disclose informatio it holds on a customer, and this fact in itself is likely to impact the type and amount of data being held.