Which statement lists the key elements of Piedmont's privacy policy?

Which statement lists the key elements of Piedmont's privacy policy?

• A. Data retention for 10 years, no consent needed.
• B. Privacy policy only applies to customers.
• C. Data minimization, purpose limitation, consent, access controls, breach notification.
• D. Share data with third parties without notice.

Answer: (C)

The important idea here is what makes up a strong privacy policy: it should cover data minimization, purpose limitation, consent, access controls, and breach notification. Data minimization means collect only what you actually need; purpose limitation means you use data only for the specific purposes you’ve stated; consent means you obtain permission for data processing; access controls ensure only authorized people can view the data; breach notification requires informing users promptly if a security incident occurs. This combination reflects responsible data handling and transparency. The other statements don’t fit because they propose practices that violate those principles: retaining data for a long time with no consent undermines user control; limiting the policy’s applicability to customers narrows who is protected; and sharing data with third parties without notice breaks transparency and consent.

The important idea here is what makes up a strong privacy policy: it should cover data minimization, purpose limitation, consent, access controls, and breach notification. Data minimization means collect only what you actually need; purpose limitation means you use data only for the specific purposes you’ve stated; consent means you obtain permission for data processing; access controls ensure only authorized people can view the data; breach notification requires informing users promptly if a security incident occurs. This combination reflects responsible data handling and transparency.

The other statements don’t fit because they propose practices that violate those principles: retaining data for a long time with no consent undermines user control; limiting the policy’s applicability to customers narrows who is protected; and sharing data with third parties without notice breaks transparency and consent.