A company implements new monitoring software that captures screenshots of employee workstations every five minutes to ensure productivity. However, some employees handle client financial data and access third-party critical infrastructure systems as part of their work.
What is the MOST appropriate action before deploying the monitoring system?
A. Proceed with deployment since monitoring is part of legitimate business interests.
B. Obtain written consent from employees acknowledging they are subject to monitoring.
C. Conduct a privacy impact assessment (PIA) to evaluate legal, ethical, and security implications.
D. Encrypt all collected screenshots to protect sensitive data.