P2020-ND-111

On July 10, 2019, an employee of the Organization had a conversation with two other individuals ? a former employee and another employee ? during which the first employee shared the information at issue in an unauthorized manner. On July 16, 2019, the second employee reported the incident to his manager, and the Organization began an investigation. The Organization discovered that the first employee had authorized access to a spreadsheet of aggregate, non-identifiable compensation data; however, the spreadsheet also included hidden data with individually identifiable information. The Organization reported that ?While it was not apparent that the spreadsheet contained supporting data, when [the first employee] clicked on the aggregate, non-identifiable compensation value it revealed the underlying data.?