You’re assuming they actually understand proper data protection procedures. You have a very misplaced amount of faith in the knowledge of the average person.