SCENARIO Please use the following to answer the next QUESTIO N: Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for…

The Handy Helper application has multiple, fundamental privacy flaws that would violate the GDPR, including bundled consent, processing of sensitive (special category) data without a clear legal basis, lack of purpose limitation (the "Eureka" program), and failure to implement the principle of least privilege for internal data access. To minimize the significant legal and financial risks of launching in Europe, the most effective and responsible action is to proactively review and remediate these issues. Making this a "gating item" ensures that the product is not released until it meets compliance standards, directly embedding the principles of Privacy by Design and by Default into the product development lifecycle.

A. The EU-U.S. Privacy Shield Framework was invalidated in 2020 (Schrems II) and is not a valid data transfer mechanism. It also would not address the product's internal compliance failures.

C. Documenting the data life cycle is a necessary step to understand the data flows, but this action alone does not fix the underlying non-compliant processes or minimize the risk.

D. A privacy policy is required for transparency, but simply writing a policy to describe non-compliant practices does not make them legal or mitigate the associated risks.

1. GDPR

Article 25

"Data protection by design and by default": This article mandates that the controller shall "...implement appropriate technical and organisational measures... both at the time of the determination of the means for processing and at the time of the processing itself... in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects." Option B is a direct application of this principle.

2. Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP. In Chapter 5

"Privacy in Technology

" the text emphasizes the importance of integrating privacy reviews into the systems development life cycle (SDLC). It states

"The privacy professional should be involved in the SDLC from the requirements-gathering phase through to disposal... to ensure privacy requirements are identified and built into the system from the outset." (p. 135). This supports remediating the product as a gating item before release.

3. Cavoukian

A. (2011). Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario

Canada. The principle of "Privacy Embedded into Design" states that privacy must be embedded into the design and architecture of IT systems and business practices

not bolted on as an add-on. Option B

which calls for remediation before release

aligns perfectly with this foundational principle.