One recently settled lawsuit contended employers should have protected employees from plan administrators using their information to sell them products.