The correct answer is C because collecting personal data without consent, or without another valid legal basis, is a major privacy concern. Privacy principles require that personal information be collected fairly, lawfully, transparently, and for defined purposes. Individuals should generally understand what data is being collected, why it is being collected, how it will be used, and with whom it may be shared. More storage requirements and increased resources are operational concerns, but they are not the greatest privacy issue. An outdated privacy policy is a concern because it may fail to reflect current practices or legal requirements, but the more direct and serious privacy violation is collecting data without proper consent or lawful basis. In CISM risk management, privacy risk includes unauthorized collection, excessive collection, improper use, inadequate notice, and noncompliance with legal or regulatory requirements. Because unauthorized or nonconsensual collection can create legal, regulatory, reputational, and ethical consequences, data collected without consent is the greatest concern among the options.