First of all, I'm not going to go and look, but I would wager that pretty much any hotel web page that you book rooms through has similar terms and conditions. The odds are that the Sheraton site this person subsequently used provides the same terms and conditions.

Secondly, its simply NOT true that you have no recourse. Its the same situation as when you park in a public parking garage. You know how your little ticket and the sign when you enter both see something to the effect of "the garage disclaims all liability for damages suffered to your car while you are parked here"? One of the first things we learned in my law school torts class was that, surprise surprise, even with that little disclaimer, they are still liable if your car gets messed up. They put that there becuase most people will assume that they can't sue and won't. Its the same thing here. Many people probably wouldn't think to sue when confronted with this clause, but that doesn't mean you can't if Hilton does something careless with your information and you suffer damages because of it.

Anyway, its highly unlikely Hilton is going to pass along your name and address to other people, much less your credit card information. The former would run the risk of alienating numerous customers and do far more harm then the limited profit they would yield by selling the data would warrant. The latter could create numerous problems.. including, if used for illegal purposes (and this is probably a stretch but it could happen and someone might try to make the charge if it did), possibly subjecting them to some type of criminal charges for passing credit card information. Somehow I doubt that that is the type of reputation or publicity Hilton wants to get.