I forgot that not everyone who manages data even begins to understand the risks. It’s one thing to maintain contact information for members, it is another thing to add photos to it, especially when children are involved. I tried to explain that I was concerned that without any privacy policy in place (not to mention security process) that there was no way to ensure that this data would not spread to anyone who had nefarious intent, either through negligence or simple lack of education. Neither she nor her boss had a clue what I was talking about. I immediately asked her to delete the photo from her camera. In fact I suggested that I was willing to help formulate a security policy to help decrease their exposure.