A staff of a marketing research company is transferring some personal data of customers to other business partners. Moreover, some of the personal data collected are stored at the company share drive that other unauthorized staff can assess to view this data.

Discuss the acts of the staff to transfer client personal data to business partner. Besides, please suggest security measures that should adopt in order to improve the security system in protecting personal data held by the company.