You are the CISO working for a direct bank based in Taiwan that relies entirely on internet banking. The software development team is developing a customer relationship management (CRM) system. You are drafting the privacy policy for customer data. Which of the following behavior of the system will concern you most?
A. It shows the privacy policy with the opt-in option to consent
B. It provides an “unsubscribe” link to opt-out of receiving marketing emails
C. It constrains the customer from updating personal data to meet the use limitation principle
D. It opens to the customer to update personal data online

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is C. It constrains the customer from updating personal data to meet the use limitation principle.

When it comes to personal data or privacy, enterprises should consider the OECD and ISO 29000 privacy principles, local laws and regulations, and global privacy requirements, e.g., GDPR, GLBA, HIPAA, and so forth.

Privacy Policy Consent

The opt-in option to consent and opt-out of receiving marketing emails are common and meet the OECD Openness Principle and Purpose Specification Principle.

Opt-in vs Opt-out

• Opting in means that a user will take an affirmative action to offer their consent.
• Opting out means a user will take action to withdraw their consent.

When it comes to getting user consent to your privacy policy and terms and conditions, we always recommend you use an opt-in approach.

Source: Termly

The data protection agency of the UK explains opt-in boxes in this way:

Opt-in boxes are boxes where a tick indicates that the person agrees to receiving the specified marketing. Best practice is to provide an unticked opt-in box, and invite the person to confirm their agreement by ticking. This is the safest way of demonstrating consent, as it requires a positive choice by the individual to give clear and explicit consent.

Source: iubenda

The Tradeoff between Opportunities and Threats

To constrain the customer from updating personal data is unpractical for online banks and does not meet the Data Quality Principle. There is a tradeoff between business opportunities and information security, which should be considered as a business enabler (or even business driver) to support doting business in a secure context.

Providing customer access to update personal data online is common. It meets the OECD Individual Participation Principle and Data Quality Principle. On the other hand, there indeed exist security concerns, so the bank should follow Security Safeguards Principle, Accountability PrincipleHowever, and other OECD principles and manage the risk to an acceptable level.