They could get consent from users before handing out the information to third parties.
And academics are the ones who need to go through difficult procedures to record data willingly given by actual conscious human beings?
Still, this one should become the standard apology for most mess-ups:
This was a screw-up, and we’re angry and upset about it. It was an innocent enough attempt to reach out to the academic community with new research tools, but it was obviously not appropriately vetted, and if it had been, it would have been stopped in an instant […] Although there was no personally identifiable data linked to these accounts, we’re absolutely not defending this. It was a mistake, and we apologize. We’ve launched an internal investigation into what happened, and we are taking steps to ensure that this type of thing never happens again.
Nice! Some people have read the Cluetrain Manifesto!