I am pretty sure Google leeched my contacts from my phone in a similar way once. There need to be hard penalties here since the company cannot undo the damage. It might just have been a bug on their end, but it is fairly possible implement data sharing in a way that errs on caution. Especially for a company that allegedly values private information.