Department did not comply with all statutory conflict-of-interest requirements and effectively safeguard its IT systems and sensitive data