[cremp]

All ISPs have privacy policies. 99% of all privacy policies are either copy/pasted from elsewhere or written in legalese so that company can do whatever they want. 'Internal business use' is a nice fodder for 'Selling data to increase this general ledger account for later business use.'

An audit is almost always under bad pretenses. If I spend $$$ on an audit company, the company itself has bias.

The difference between third-party audits and government issued audits (think food safety) is that the government has nothing to gain by a positive, or negative result.

IANAL, just cynical of people.