Sorry, I'm relatively new here, so I don't know the etiquette, so I'm responding to you directly. I appreciate the question!
Firstly, it's not a matter of what's the harm, it's a matter of what's their right. The only person with a right to my information is me. I can appreciate the need for financial data sharing (note: need), but I don't appreciate the "need" of phone application data.
My example above with music is a good one. What if the CRIA (RIAA up here) decides to come after me for my music collection, based solely on data gleaned from this company. I own 800+ cds, I've dutifully ripped them all, I've bought another 100+ albums on iTunes, eMusic, etc. But I can't prove the eMusic ones. They're MP3s, and more importantly, because I'm pro-privacy, each one has been regenerated from the original MP3s, headers ripped. That means the MP3 looks nothing like the one I purchased. The problem in the current court system is that although the notion of innocent until proven guilty exists, it would take a long time to establish that reasonable doubt. And this is for legitimate usage of my music collection.
Let's go a (perhaps crazy) step further, pretend you're in America (disclosure: I'm in Canada), and you have two political parties. Political party "A" produces an app that you download, just to check it out. All of a sudden you're deemed to be an "A" as opposed to a "B". As data gets sold, or to be legally accurate "shared only within our partner organizations" you apply for a mortgage at a bank wherein the loan officer is affiliated with "B", and your loan gets denied? Why should your political interest (not even affiliation) have anything to do with your ability to receive financing.
Extend that concept to interest in health insurance, or VPN network usage, or a more realistic general interest in chemistry (I like model rockets, they need propellant).
The reality of the situation is that corporations cannot be trusted, neither can government. At the very least the EXTREME MAJORITY of Terms of Service agreements make it abundantly clear that "data is only shared with partners" or something similar. The net result is that anyone can partner.
Sorry if that came off rantish.