implement a comprehensive consumer privacy and data security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity, and the nature and scope, of the activities of the covered entity. (2) Design The consumer privacy and data security program shall be designed to— (A) ensure the privacy and security of sensitive personally identifying information