My understanding is they were breaking regulation by not. The company I work for does customer opinion surveys. We occasionally do some for a large national bank. When we send data, of any form to the bank we are required to encrypt the email before we send it. This is just for something like random customer surveys not even at the level of actual account data.