1.Max Brown works in the Department of Alcoholism and Drug Abuse of a north-eastern state. The agency administers programs for individuals with alcohol and drug problems and maintains huge databases of information on the clients who use their services. Max has been asked to take a look at the track records of the treatment programs. He is to put together a report that contains information on the clients who use their services. Max has been asked to take a look at the track records of the treatment programs. He is to put together a report that contains information about such factors as number of clients seen in each program each month for the past five years, length of each client's treatment, number of clients who return after completion of a program, criminal histories of clients, and so on.

In order to put together this report, Max has been given access to all files in the agency's mainframe computer. It takes Max several weeks to find the information he needs because it is located in a variety of places in the system. As he finds information he downloads it to the computer in his office; that is, he copies the information from the mainframe onto the hard disk of his office microcomputer.

Under pressure to get the report finished by the deadline, Max finds that he is continuously distracted at work. He decides that he will have to work at home over the weekend in order to finish on time. This will not be a problem. He copies the information (containing, among other things, personal information on clients) onto several disks and takes them home. He finishes the report over the weekend and decides to send it to his office computer by email and fax. He leaves the disks at home and forgets about them.

1. Was Max wrong in moving personal information from the mainframe to his office computer?
2. Was Max wrong in leaving the disks containing personal information at home?
3. What might happen as a result of Max's treatment of the data?
4. Should the agency for which Max works have a policy on use of personal information stored in its system? What might such a policy specify?