Was Janet correct in her interpretation of the privacy policy or was she making too big a deal? Would there be any negative consequences of sending out the questionnaire to everyone? What other...

Was Janet correct in her interpretation of the privacy policy or was she making too big a deal? Would there be any negative consequences of sending out the questionnaire to everyone? What other sensitive information might need to be protected (kept private)? How long do you think iSec-Cert should maintain sensitive information?