Comment by jfengel

These weren't personal data. They were business records. They didn't specify but it might be things like who was accessing what and when.