You are thinking way too small about what can be done with that amount of data on you. I’ll give you an example. I once did some programming work for a website. The website got ‘hacked’ (An administrative admin had their password guessed because they weren’t using good password habits). This website had poor security and with the admins password the ‘hacker’ was able to get a DB dump. Bad stuff. So me and another guy set out trying to identify who had done it. Via server logs we were pretty sure we had correctly tied the ‘hacker’ to a user of the site. By looking at their activity on the site, and what referral links they had followed to get to the site previous, we learned where they approximately lived and their first name. But we knew we needed more info than that, so we looked at his hobbies and figured out he liked pokemon quite a lot. We then created a ‘what pokemon are you’ quiz, asking mostly unimportant questions, but throwing in a couple we needed in order to be able to report him to his local authorities (IE their last name and some other info I can’t remember off the top of my head). We then had this quiz get posted by an account not associated with the running of the site. the ‘hacker’ filled it out, and we reported him for breaking the law with our evidence to his local authorities.

So to reiterate, 2 idiots with no background in data science and like 16 hour between us, were able to manipulate an arbitrary guy into doing what we wanted because of a relatively small amount of data. Now Imagine what people dedicating their lives to this stuff can do to you.