It's not "their" information. It's information about them. I collected it and stored in my servers that I'm paying for, and that makes it my information. Your laws may say differently, but practicality wins here.
Do your users know what information you collect, and what for? If they don't, you're being creepy. Here's the same thing taken to a logical extreme:
"I shoot this sex tape myself with my camera, climbed my tree on lawn, zoomed with my long focus lens, stored it in my computer. It's my data. If they don't like it, they should have pulled their curtain."
There must be a threshold somewhere. When does it stops being acceptable, and starts being creepy?
I'm pretty sure in my country (France), only the police may peep through windows with optical instruments. The work of a private investigator you speak of may very well be illegal, assuming the investigator is not an on duty police officer.
Public places are one thing (he entered this building with that woman at this hour). Looking through private property is another.
Under Canadian Law (which you are subject to, according to your profile) and you're liable if you decide to snoop on a specific persons data, or misuse it in a way that they didn't intend. So, it doesn't seem to be completely your information.
> Your laws may say differently
Sure, Canadian laws in this area are very scattered and backwards. I wouldn't put that forward as a good thing though, or use it as a pretense to not bother protecting or managing your users PII.
