A marketing agency receives a customer list ‘to help with a campaign’ but is given no instructions on permitted purposes, retention, or deletion. Which third-party sharing requirement is most clearly missing?
Select an answer to reveal the explanation.
Short Explanation
Handing over a customer list without rules is like lending your keys with no address on the tag. Purpose, lawful basis, and protective instructions—including how long to keep and when to delete—have to travel with the data. A vague ‘help with a campaign’ is not a complete brief.
Full Explanation
Defined purpose, lawful basis, and protective arrangements—including instructions on use and deletion—must accompany sharing of personal data with third parties. A marketing agency given a customer list “to help with a campaign” without instructions on permitted purposes, retention, or deletion is missing that core discipline and creates uncontrolled secondary-use risk. Third parties may not invent any secondary purpose once a list is emailed. Deletion instructions are not unnecessary merely because the agency’s name appears somewhere in a privacy policy. Campaign lists are not automatically anonymous. Exam caveat: purpose limitation + instructions/safeguards are essential to third-party sharing. Operational check: issue written processing instructions with purpose, retention, deletion, and prohibited uses before any civic customer-list transfer, and verify deletion after the campaign ends. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.