(3) The factors that are relevant in determining whether a loss or disclosure of, or unauthorized access to, personal information would be considered by a reasonable person as creating a risk of harm are (a) the sensitivity of the personal information; and