While smaller companies may be primarily at fault for privacy breaches lately, data exposures at Web sites run by larger companies also can happen and when they do they can pose an even greater risk, according to Ari Schwartz, policy analyst at the Center for Democracy and Technology in Washington, D.