Sometimes when the information policy is violated, the misuse of information results in there being a victim. At what point do you think the act of violation becomes criminal? Also, when should the company be liable and when should it not be liable for misuse of information?