When it comes to protecting personal data, security gurus make their own rules