With little regulation and sometimes outright deception, the possibility of discrimination and other “data harms” is high