Comment by robertlagrant

They have legal rights until the data is detached and deidentified.