Which of the following is not true about a private companys obligation to protect personal information?

Companies must guard against both intentional and accidental disclosure of personal information.

A company can be subject to criminal prosecution if it does not adequately protect personal information.

A company must protect all confidential information, even if it is on paper.

A company is required to protect customer, not employee information.

A company can be subject to civil suit for failure to prevent the release of an employees private information.