The data didn't have the security it's supposed to have when it's off premises. That was a violation of policy.