Well in California (The SUE ME STATE). There are many laws with regards to when/why/how data is collected.

Of course it also depends on who your lawyer is too (ask OJ)

But the fact of having a banner that the user did not have to agree to (user can only click OK, you did not give option of No or Cancel)

You must also now notify any user Public/Private if any unauthorized individual has or might have accessed personal information that might lead to identity theft or disclosed financial/medical or similar information.

Even items that may only be a misdemeanor locally can become a felony when the information is carried across state lines.

VERY GRAY area to play with here if you don't have a legitimate reason, seeing that often you as an Administrator can also be held liable and not just your Company.

Don't think any of us are lawyers here, but speaking for myself I'll just steer clear of this type of activity unless our own legal department makes and authorizes the request.