Sloppy, non-privacy-preserving "analytics" set up by some communications intern ≠ malice. They can mean well and still do a poor job. True privacy on the internet is notoriously hard.
I don't think you can handwave responsibility like that, even if your theoretical were true it's still the responsibility of the org.
I don't think you can handwave responsibility like that, even if your theoretical were true it's still the responsibility of the org.