When sharing a customer's identity with a third party, under what condition may you proceed?

When sharing a customer's identity with a third party, under what condition may you proceed?

• A. Explicit consent or legal requirement; verify identity and purpose.
• B. Only if the third party is a partner.
• C. If the customer is located abroad.
• D. If the data is anonymous.

Answer: (C)

Disclosing a customer’s identity to a third party must rest on a lawful basis. The condition that really lets you proceed is having explicit consent from the customer or a legal requirement that obligates the disclosure. In practice, you should also verify who is requesting the information and the specific purpose of the sharing, and ensure you disclose only what is necessary for that purpose. Merely having a business partner, the customer being in a different country, or the data being anonymized does not alone justify sharing; consent or a legal obligation governs whether the disclosure can occur, and anonymized data would not reveal a customer’s identity.