If a business follows an "opt-in" policy for handling personal data, information about a customer (c) may be released unless the customer requests that the information be kept private (b) may not be released unless the customer gives permission (d) may be released for any legitimate business purpose (a) may not be released under any conditions