When personal information is transmitted across networks, there MUST be adequate controls over: 

Answer options:

A. change management.
B. privacy protection.
C. consent to data transfer.
D. encryption devices.

B

Privacy protection is necessary to ensure that the receiving party has the appropriate level of protection of personal data. Change management primarily protects only the information, not the privacy of the individuals. Consent is one of the protections that is frequently, but not always, required. Encryption is a method of achieving the actual control, but controls over the devices may not ensure adequate privacy protection and, therefore, is a partial answer.