Which statement best describes a legitimate purpose for collecting information?

Which statement best describes a legitimate purpose for collecting information?

• A. To prevent crime, protect property, ensure safety, or comply with laws or contractual obligations.
• B. To monitor customer preferences for advertising.
• C. To publish private data publicly.
• D. To extend loyalty program without consent.

Answer: (A)

When deciding if collecting information has a legitimate purpose, the focus is on aims that are lawful, necessary, and appropriate for the organization or situation. The statement that includes preventing crime, protecting property, ensuring safety, or complying with laws or contractual obligations covers foundational, accepted grounds for data processing. These purposes are designed to protect people and assets and are often required by law or contract, making them clearly legitimate. Other potential uses, like monitoring for advertising without consent or publishing private data publicly, either overstep privacy boundaries or lack a proper legal basis, so they don’t fit the idea of a legitimate purpose. In practice, organizations should tie data collection to these lawful aims, keep the amount collected to what’s needed (data minimization), and be transparent about why the data is being gathered.

When deciding if collecting information has a legitimate purpose, the focus is on aims that are lawful, necessary, and appropriate for the organization or situation. The statement that includes preventing crime, protecting property, ensuring safety, or complying with laws or contractual obligations covers foundational, accepted grounds for data processing. These purposes are designed to protect people and assets and are often required by law or contract, making them clearly legitimate. Other potential uses, like monitoring for advertising without consent or publishing private data publicly, either overstep privacy boundaries or lack a proper legal basis, so they don’t fit the idea of a legitimate purpose. In practice, organizations should tie data collection to these lawful aims, keep the amount collected to what’s needed (data minimization), and be transparent about why the data is being gathered.