In scenario 1 the officer stepped away from the copier to take a break, he left grievance documents on the copier. This type of privacy breach is human error and possibly theft from the photocopier person.

In scenario 2, the professor tells the student's roommate details about a hearing. This student had nothing to do which the situation and did have the right to know.

Scenario 3, an employee accesses student records without her authorization. "Misuse of computer systems: One of the predominant internal security threats is employees' unauthorized access to or use of information, particularly when it is confidential and sensitive" (Thite K., Johnson R., 2012) .

In all scenario's I would investigate and provide disciplinary actions to the staff responsible. Refer to our privacy plan. Typically, you would call the state (I live in California), notify the consumer.

"Employees – it is incumbent upon all employees of the OPC to inform themselves of their obligations under this Policy and the Privacy Act. Employees must report any and all contraventions of the Policy or the Act to their manager or to ATIP.

Managers and Supervisors – along with the responsibilities noted above, managers and supervisors are required to issue instructions to their staff (as necessary) in order to ensure the adherence to this Policy and the Act. They are also required to examine and/or make inquiries into any issues brought to their attention concerning this Policy and the Act. Where and as appropriate, managers and supervisors must notify, work in concert with, or refer certain matters to the Director of HR and the Departmental Security Officer.

OPC Chief Privacy Officer – the OPC Chief Privacy Officer (CPO) will provide advice and guidance to Senior Management, managers, supervisors and employees of the OPC with respect to the treatment of personal