NextDoor Neighbor Mortgage, a mortgage lender, collects priv…
NextDoor Neighbor Mortgage, a mortgage lender, collects private financial data on its customers as part of its routine business practices. In 2019, the email account of Don Irvine, an employee of the company, was accessed by an unauthorized person. That unauthorized person potentially gained access to a significant amount of sensitive personal data related to mortgage loan applications. When Don reported this incident to his supervisor, Don explained that he did not know whether the personal data was encrypted at the time of the incident. No investigation was conducted in 2019. In 2021, mortgage regulators learned of the incident and initiated an investigation. As the new Privacy Officer for NextDoor Neighbor Mortgage, the CEO has asked you what steps NextDoor Neighbor Mortgage should have taken in 2019 in response to the email incident. What do you advise the CEO?