E-mail the story: Is personal data safe at firms?