. . . "This could include data such as HR and employee data, which, in many cases as consumer PII, is subject to data breach notification laws in all but a handful of U.S. states." . .