Private corporate data are often encrypted using a key, which is needed to decrypt the information. Who within the corporation should be responsible for maintaining the "keys" to private information collected about consumers? Is that the same person who should have the keys to employee data?