Question

A retail company originally collected customer email addresses solely to send order confirmations and shipping updates. The marketing department now wants to use those same email addresses to send promotional newsletters and personalized product recommendations. As the privacy solutions engineer advising on this request, which privacy principle is most directly at risk, and what is the appropriate first action?

Accepted Answer

The purpose limitation principle is at risk; the company must assess whether the new use is compatible with the original purpose and, if not, establish a valid legal basis such as obtaining consent before proceeding

Answer

The data minimization principle is at risk; the company should immediately delete all email addresses that are not strictly required for order processing

Answer

The accuracy principle is at risk; the company should verify that all email addresses are current before sending any newsletters

Answer

The storage limitation principle is at risk; the company should extend the retention period for email addresses to support marketing activities