B. It provides an “unsubscribe” link to opt-out of receiving marketing emails
C. It constrains the customer from updating personal data to meet the use limitation principle
D. It opens to the customer to update personal data online
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is C. It constrains the customer from updating personal data to meet the use limitation principle.
When it comes to personal data or privacy, enterprises should consider the OECD and ISO 29000 privacy principles, local laws and regulations, and global privacy requirements, e.g., GDPR, GLBA, HIPAA, and so forth.
The opt-in option to consent and opt-out of receiving marketing emails are common and meet the OECD Openness Principle and Purpose Specification Principle.
Opt-in vs Opt-out
- Opting in means that a user will take an affirmative action to offer their consent.
- Opting out means a user will take action to withdraw their consent.
The data protection agency of the UK explains opt-in boxes in this way:
Opt-in boxes are boxes where a tick indicates that the person agrees to receiving the specified marketing. Best practice is to provide an unticked opt-in box, and invite the person to confirm their agreement by ticking. This is the safest way of demonstrating consent, as it requires a positive choice by the individual to give clear and explicit consent.
The Tradeoff between Opportunities and Threats
To constrain the customer from updating personal data is unpractical for online banks and does not meet the Data Quality Principle. There is a tradeoff between business opportunities and information security, which should be considered as a business enabler (or even business driver) to support doting business in a secure context.
Providing customer access to update personal data online is common. It meets the OECD Individual Participation Principle and Data Quality Principle. On the other hand, there indeed exist security concerns, so the bank should follow Security Safeguards Principle, Accountability PrincipleHowever, and other OECD principles and manage the risk to an acceptable level.