A retailer's marketing team wants 200,000 prospect emails from a data broker for next week's launch. The prospects fall under several privacy regimes and nobody knows how consent was obtained. What should the security manager do FIRST?
A. Require a data processing agreement from the broker
B. Have legal confirm a lawful basis for using the list
C. Review the broker's security certifications and audits
D. Add an opt-out link to every campaign message
(Explain your answer for more points in the comments!)