When a public-sector organization releases records to the wrong person, the consequences can be serious, including unauthorized disclosure of personal information, potential harm to affected individuals, reputational damage, and costly incident response.