Question

A privacy risk assessment identifies that a marketing platform stores full customer date-of-birth values that are only used to verify a minimum-age eligibility of 18. The residual risk of retaining exact birth dates is rated high, and the business insists the age-verification function must be preserved. Which risk treatment should the privacy engineer recommend FIRST?

Accepted Answer

Mitigate the risk by replacing stored birth dates with a derived over-18 boolean flag

Answer

Accept the risk formally since the business requires the age-verification capability

Answer

Transfer the risk by purchasing cyber-liability insurance covering the birth-date data

Answer

Avoid the risk by discontinuing the marketing platform entirely