Question

An agency has implemented a data retention policy that requires tagging data according to type before storing it in the data repository. The policy requires all business emails be automatically deleted after two years. During an open records investigation, information was found on an employee's work computer concerning a conversation that occurred three years prior and proved damaging to the agency's reputation.

Which of the following MOST likely caused the data leak?

A. The employee manually changed the email client retention settings to prevent deletion of emails
B. The file that contained the damaging information was mistagged and retained on the server for longer than it should have been
C. The email was encrypted and an exception was put in place via the data classification application
D. The employee saved a file on the computer's hard drive that contained archives of emails, which were more than two years old

Answer 1

The most likely cause of the data leak is that the file containing the damaging information was mistagged and retained on the server for longer than it should have been.

Step-by-step explanation:

The MOST likely cause of the data leak in this scenario is option B. The file that contained the damaging information was mistagged and retained on the server for longer than it should have been. The data retention policy requires business emails to be automatically deleted after two years. If the file was mistakenly tagged or not properly categorized, it may have been overlooked during the deletion process and retained on the server beyond the two-year mark.

Option A, which suggests that the employee manually changed the email client retention settings, is less likely because the policy indicates that emails should be automatically deleted after two years. Option C, which mentions encryption and exceptions, is also less likely because it doesn't directly address the retention period. Option D, the employee saving a file on the computer's hard drive that contained archives of emails older than two years, would not have caused the data leak if the file was not accessed or shared externally.

The most likely cause of the data leak in the scenario where a conversation from a business email was found on an employee's work computer even though there was a data retention policy that requires emails to be deleted after two years is that the employee saved a file on the computer's hard drive that contained archives of emails. This indicates that the employee took deliberate action to retain the emails beyond the data retention policy's timeframe, bypassing the automated deletion process. The presence of such emails on the employee's personal computer suggests a failure to adhere to the policy rather than a mistagging issue or a system-based exemption.