A breach does not significantly affect an individual when the Personal Information  in question is subject to suitable technological protection measures (e.g., encryption) and there is no indication that the protection has been compromised.