Playing a little arm chair lawyer on this end. I looked up privacy law (US) and found the term "Personally identifiable information" (PII). This seems to be the root of the privacy law.
http://en.wikipedia.org/wiki/Personally_identifiable_information
What I can see the important part is you need to be able to link information to a person in order to distinguish or trace a persons identity.
It also goes on to say that a company has to take reasonable measures to secure PII. But the key is seems to be "while in their possession". If you have possession of your iPhone (or any smart phone) then any data or PPI on that property would seem to be your responsibility. Not Apples or Googles.
However, if that data was specifically about you, and can be connected to you and in their possession then they must take reasonable measures to secure it.
Okay... I'm not a lawyer (thank god) and law is open to interpretation. However, it would seem like the people suing will have to prove that the data being collected is identifiable as theirs and that even though they have control of the iPhone (like you do with your checks and credit cards) that Apple has failed to take reasonable measures to protect the data.
Personally, I hope these guys loose, in my opinion, it would appear that this is industry practice. They (Apple, Google, MS, and I'm sure RIM too) are all doing it. So if they win, they will go after Google and others just soak all the companies for money.
However, I think Apple should encrypt the local file just for consumer peace of mind.
Done playing lawyer. My head hurts now.
