Earlier quoted context omitted.
Yes, as can Apple, Google, every cable company, every telecom, the credit card companies, Grindr, health clinics
Yes, and the handling all of that personal data should be strictly regulated. Ideally, companies would be treating all of it as toxic waste, and disposing of it as soon as possible.
If however there were strict liabilities for data leaks or privacy breaches, businesses would collect just the bare minimum data and get rid of it as soon as it is not strictly needed.