They mostly can, except for certain sensitive information. Some things should be regulated - I'm glad there are safety standards, and this is a (very basic) safety standard for data.