A few years ago Clare Applewood started a small outdoor equipment business called Mountain Top View. The company is a sole proprietorship. The company began as a single storefront and has grown rapidly to include online ordering through the company website. The company's website includes the statement, "We are committed to keeping customer information secure and protected." Clare also uses social media sites to market the company.

Carlos Rodriguez has worked for the company since the beginning. He oversees both store and online operations. Clare and Carlos make most decisions together.

Steve, the company's Information Technology lead, discovered that the company database of customer information was hacked. Customer names, addresses, and phone numbers were accessed for only those customers who placed online orders in the first quarter of the year. Steve was able to correct the code that allowed the hack and is confident that the database is now secure.

When Carlos overhears Steve talking about the database fix in the store break room, he questions Steve about why he did not bring the breach to anyone's attention. Steve explains that because he was able to quickly correct the code that led to the breach, and because only address and phone number information for a handful of customers was accessed, he didn't think it was necessary to say anything.

Clare asks Carlos to evaluate whether the company has an ethical and/or legal obligation to report the breach to their customers and to recommend a course of action. She also asks Carlos to select an ethical test or framework that all employees can use in the future to help guide their decisions.

Directions

1. Analysis
2. Provide a summary of the ethical and/or legal issues involved in this situation.
3. Briefly describe the relevant stakeholders, the key facts, and the potential implications or impact of the situation.