Why is the boundary of a firm relevant? If Amazon buys a shoe store, does that make them more legitimate in their use of your shoe shoppng data than before? This seems like an arbitary choice that is biased in favor of big companies.
Incorporation isn't the boundary. Again, why are you conflating business data with the personal data of someone using a product that has nothing whatsoever to do with the business transaction.
If Amazon buys a shoe store, they get the sales records and any other related data. They do not get to know where you walk with their shoes.
If there is any confusion here, it is because of the recent trend in Services as a Software Substitute that makes the business's server necessary for normal use of their product. Some people seem to think this lets them open the packages they are conveying or storing.
