This isn't about protecting users from spying. This is about managing user data and privacy in accordance with the laws that privately-owned businesses must abide by. You can claim that it's a double-standard, but it's still wrongdoing and needed to be sorted out either way.