What the law, in the US at least, assures is that third party data hosting services must adhere to a baseline for security, in short requiring some form of protection on data that is not very well defined.