(88) In determining the specific provisions on the form and procedures applicable to the notification of a personal data breach, consideration should be given to the circumstances of the breach, including whether the personal data was secured with appropriate technical protection measures that effectively reduce the likelihood of identity fraud or other forms of abuse. In addition, these regulations and procedures should take into account the legitimate interests of law enforcement agencies if premature disclosure could unnecessarily impede the investigation of the circumstances of the personal data breach.