- who has access and are they using it for official business?
- what if it's hacked?
- who is it shared with and who do they share it with after that? private companies for analysis?