Explanation
To ensure the protection of personal data, privacy policies should mandate that access to information system applications be authorized by the business application owner, because they are the ones who are responsible for defining the business requirements, functions, and objectives of the applications. The business application owner can also determine the appropriate level of access for different users or groups based on their roles, responsibilities, and needs. The business application owner can also monitor and review the access control policies and procedures to ensure that they are effective and compliant with the privacy regulations and standards.
References:
* Access Control Policy and Implementation Guides, CSRC
* What is Authorization and Access Control?, ICANN