Can't answer to 'Proven' on account of comment depth, but I am not concern trolling. I work as a ML engineer and many of our projects and datasets are sensitive. The company has signed contracts of confidentiality for this data and we are really concerned about where it sits and who gets access to it.

Another major concern is GDPR - can you reliably track and delete data related to a specific person? You got to think about this right from the start to keep the necessary metadata in the tagging pipeline.