[drdeca]

Secretary? I’m not really talking about an organization, I’m talking about an individual.

A few hours of training is reasonable enough, I suppose?

Seems like it might be simpler to just have whoever is responsible be liable for any problems that could arise from not keeping the list secure? I guess maybe an issue issue with that is that it would be hard to track down all the harms that actually occurred as a result of letting the list fall into the wrong hands, and also hard to even get a good estimate.