The privacy issue in this scenario is that the users were not informed as to what information collected would be shared with other users, and they did not give their consent to share their information. This violates the privacy principles of notice and choice, which state that the users should be notified of the data collection and sharing practices of the organization, and they should be given the option to opt-in or opt-out of the sharing feature. The technical control that should be put in place to remedy the privacy issue while still trying to accomplish the organization's business goals is to default the user to not share any information, and to provide the user with a clear and easy way to enable the sharing feature if they wish to do so. This way, the user's privacy is respected and protected, and the user can still participate in the sharing feature if they find it beneficial. The other answer choices are not appropriate, because they either do not address the privacy issue, or they do not support the organization's business goals . References: [CISSP CBK, Fifth Edition, Chapter 1, page 35]; [CISSP Practice Exam - FREE 20 Questions and Answers, Question 20].