The states' motion asserted that an additional step is required to protect the sensitive data — appointment of a security examiner. While the CPRO would review and report on privacy policies and practices, compliance with applicable law, and the terms of a potential sale, the examiner would report on reasonable data security measures proportional to the risk and enable 23andMe to meet its commitment to protecting the secure data.