Is personal info shared externally without authorization?