which of the following is not a correct way to protect sensitive information