What they had
- A privacy regime written against a statute that is being repealed
- Personal information resting somewhere nobody can point to on a map
- A supplier contract whose data terms and whose architecture disagree
- A logging setup that cannot answer who opened what, and when