A privacy engineer is reviewing a customer loyalty program that has operated for eight years. Analysis shows many customer records contain outdated addresses, duplicate profiles for the same individual, and email fields populated with placeholder values entered by staff to bypass mandatory field validation. Marketing is using this data to send personalized offers, and several complaints have arisen because offers were sent to wrong recipients. Which action best addresses the underlying privacy principle at risk?