They will use it for nefarious but "legal" purposes - however - they have decades of experience handling such data and keeping it "safe" from "illegal" purposes.

I think an $18 billion dollar fine implies that they broke a law or two.