Yeah. I work in IT as well. Not in a megacorp like Google or Facebook, but I've been in large private companies and government agencies that you would hope would have strict privacy and security policies. Guess what? They don't.

Nobody in a position of power cares beyond the point of legal requirements, which are mostly shit. It's kind of like "military grade"; it sounds impressive, but what it actually means is "this is as cheaply made as possible while still meeting the bare minimum legal standard".