The categories of information most likely to trigger such legal obligations include health and genetic information; Social Security, driver???s license, and financial account numbers; and personal data received from the European Union and other countries, such as Australia, South Korea, or Mexico, that have enacted broad data protection regimes.