What are two legal risks of having inadequate privacy policies and procedures? (Choose two.)