A marketing team at a retail company wants to collect customer purchase histories, email addresses, and browsing behavior to build detailed profiles for targeted advertising. The data will be securely encrypted and access-restricted so only authorized analysts can view it. However, customers were never informed that their browsing behavior would be tracked and used this way. Which security principle is MOST directly at risk in this situation?