A user receives an email containing a co-workers birth date and social security number. The email was not requested and it had not been encrypted when sent. What policy does the information in the email violate