I answer questions for hundreds of companies and have worked in the banking industry where this policy is not just an accepted practice (security roaming the halls), it is mandated by auditors and the Feds. Other small companies that provide services for government (state and federal) as well as any company that accepts a credit card payment are also under similar rules. Personally identifiable data (ie, your SSN, driver's license #, credit card numbers, etc) cannot exist in an open environment. See PCI in Wikipedia:
http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard