Businesses that possess personal data required to notify persons whoseinformation has been disclosed to unauthorized persons.