cites personal data violations