Question

A marketing manager wants to run a campaign that reuses customer email addresses for a new purpose not covered by the original consent. The company's internal marketing policy permits this, but a newly effective state privacy law in the customers' region requires fresh opt-in consent for any new use. The manager asks the security team how to proceed. What is the correct guidance?

Accepted Answer

Follow the state privacy law and obtain fresh opt-in consent, because laws take precedence over internal policies

Answer

Follow the internal marketing policy, since company policies are the organization's authoritative governance documents

Answer

Proceed with the campaign because consent was already given once and remains valid indefinitely

Answer

Escalate to the marketing manager to decide, since business owners have final authority over their own data