This is certainly a case where law will trump any sort of explicit-or-implied contract, as law always does. And this might well be a situation where you absolutely need the advice of a qualified attorney, as expressed in a notarized letter on that attorney's letterhead. Even if that opinion costs you a thousand bucks (and it probably won't), it could save you considerably more. If you actually do get sued, this concrete evidence of “due diligence” could be priceless.

People these days are really starting to figure out how insecure this technology can be, and just how cavalier they (and perhaps we) have all been about it. You can find yourself the victim not only of a tort but of an actual felony and it's hard to say just how far the liabilities might go ... or, indeed, should go. I guess it's time we all need to sober-up, so to speak, and proceed a lot more cautiously.

I worked with one client a few years ago who, I think quite sensibly, said “if you want access to this confidential data, contact us, and we will send you a copy of our agreement. When you sign and return this document, notarized, we will issue you a revocable digital-certificate giving you auditable access to our system.” That's covering your posterior about as thoroughly as you could. But his comment made a lot of sense to me:   “if ‘the Internet’ wasn't here, this is what we would do with regard to any material of this nature. Why should ‘the Internet’ change that principle?” Why, indeed.

(INAL ... and glad of it.)