Which of the following is NOT a recommended practice for protecting personal information?

• A. Limit the personal information collected from customers.
• B. Allow employees to use laptops without any restrictions.
• C. Use encryption to protect all personal information stored by the company or sent to third parties.
• D. Restrict employees' access to the personal information of customers and coworkers.

Answer: (B)

Protecting personal information relies on reducing exposure and controlling how data is accessed and stored. Allowing employees to use laptops without any restrictions creates a high risk of data leaks. If a laptop is lost or stolen, or if malware gets in, personal information could be exposed because there’s no encryption, no strong authentication, and no controls over what data can be accessed or saved on the device. This undermines confidentiality and increases the chances of unauthorized use or disclosure.

The other practices support a safer approach: collecting only what’s necessary minimizes the amount of data at risk; encryption protects data both at rest and in transit so that even if it’s accessed, it’s unreadable; and restricting access to only those who need it follows the principle of least privilege, reducing who can see sensitive information. Together, these reduce risk much more effectively than allowing unrestricted laptop use.