When is it appropriate to share a customer's identity with a third party?

When is it appropriate to share a customer's identity with a third party?

• A. Only with explicit consent or when legally required or authorized by policy; verify identity and purpose.
• B. Whenever the customer is in contact with a partner.
• C. If the customer is a public figure, no consent needed.
• D. The customer identity can be shared without consent if the data is already public.

Answer: (B)

Sharing a customer’s identity with a third party should happen only when you have explicit consent from the customer, or when the sharing is required by law or authorized by policy. Before you share, verify who is requesting the information and the exact purpose for which it will be used, confirming that this purpose matches what the customer agreed to. This protects privacy, supports data minimization, and keeps information handling transparent and accountable. Why the other ideas aren’t appropriate: Simply sharing because the customer is dealing with a partner isn’t automatically allowed—you still need consent or a clear legal basis. Assuming no consent is needed for public figures isn’t correct, as privacy rights can still apply and any sharing should be justified by policy or law. And even if data is publicly available, that doesn’t automatically authorize sharing with third parties; you should assess the need, obtain consent when required, and ensure the use is appropriate and aligned with the customer’s expectations.

Sharing a customer’s identity with a third party should happen only when you have explicit consent from the customer, or when the sharing is required by law or authorized by policy. Before you share, verify who is requesting the information and the exact purpose for which it will be used, confirming that this purpose matches what the customer agreed to. This protects privacy, supports data minimization, and keeps information handling transparent and accountable.

Why the other ideas aren’t appropriate: Simply sharing because the customer is dealing with a partner isn’t automatically allowed—you still need consent or a clear legal basis. Assuming no consent is needed for public figures isn’t correct, as privacy rights can still apply and any sharing should be justified by policy or law. And even if data is publicly available, that doesn’t automatically authorize sharing with third parties; you should assess the need, obtain consent when required, and ensure the use is appropriate and aligned with the customer’s expectations.