Yes, that would be interesting. But it would require a massive research effort, where researchers feed the system with false data, and then, in an undercover operation, i.e. pretending to be customers, request back this data. I'm afraid that would be too much to ask from journalists.

On the other hand, it's exactly the kind of research I expect from privacy protection institutions.