Under the Consumer Access principle, a consumer can do what with respect to their personal information?

• A. Deny access
• B. Access existence, use and disclosure
• C. Refuse any disclosure
• D. Require deletion

Answer: (B)

The key idea being tested is that individuals have the right to see what personal information an organization holds about them, and to know how it’s being used and who it has been disclosed to. This is what the Consumer Access principle guarantees: a consumer can request confirmation that their information exists, learn how it’s being used, and see to whom it has been disclosed.

This is why the best choice is the option that says a consumer can access existence, use, and disclosure. It directly mirrors the scope of access rights: you can verify whether the data exists, understand the purposes for which it’s being used, and identify the parties who have received it.

Denying access would contradict the whole purpose of the access right. Refusing any disclosure also goes against the principle, since the point is to know what exists and where it’s going. Requiring deletion is a different right (erasure) and isn’t what the access principle covers, which focuses on access to existing records and their handling, not the removal of data.