The answer is yes, I do believe that's possible, if data collection is done without people's consent and without them properly understanding the purposes for which the information is being used. That in fact is what explains recent personal information protection legislation. Questions like these have been on the radar for people working in technology for a long time. Regulations are being implemented, but the questions have been around for a long time. Clear guidelines are definitely required.
On the other hand, there is an important factor to consider from the CRIM's perspective. The CRIM is no longer working on these technologies. The most competitive players at the moment are the ones that collected enormous amounts of data for use in training artificial intelligence models. Now, ordinary mortals no longer have access to the amounts of data required to achieve high performance levels.
It's true, though, that the risk you mentioned is real. That's why it's essential to regulate data harvesting to make people aware of how it is going to be used and to require informed consent.