I found a story from several months back in the WSJ about the privacy of cellphone records.
According to the WSJ:
For $110, Locatecell.com will provide you with the outgoing calls from his or her cell phone for the last billing cycle, up to 100 calls. All you need to supply is the name, address and the number for the phone you want to trace. Order online, and get results within hours.
“There are probably 100 such sites” known to security officials at Verizon Wireless that offer to sell phone records, said Jeffrey Nelson, a company spokesman, who said Verizon is always trying to respond to abusive practices.
According to Privacyspot: The sites apparently get the information primarily from two sources: (1) pretexting, also called “social hacking” or “social engineering,” in which someone impersonates the cell phone owner to get the information, and (2) the sites make a deal with a dishonest employee at the cell phone company, who sends information to the site as requested.
Phone records for lawyers could help identify their clients. Phone records for top executives could help identify whether they are working on potential mergers or acquisitions. Although it looks like the phone companies are not simply selling the information wholesale, they need to do more than simply ask callers to confirm public information such as their home address and birthday before releasing confidential customer information. Call backs or use of account holder secret PINs would be a good start.