"Any organisations, including governments, which inadequately manage and protect users??? personal information, face considerable risks ??? among them damage to reputation, penalties and sanctions, lost citizen confidence and needless expense." . . . .