A reader treating notification counts as a measure of exposure would be wrong by two orders of magnitude here — and cannot tell from outside which cases are like this one.
A file containing people who died twenty years ago is not a file that was being maintained. It is an accumulation, sold as current.