A few years ago I asked a customer for a list of employees, so I could verify who could purchase on their account. They replied with their personnel files. Luckily it didn’t have social security numbers, but it had a LOT of personal information. Medical records, drug test results, stuff like that.