You are meeting with your manager, the new Chief Information Officer (CIO) of a market research and consulting firm, for the first time. The CIO shares that she just learned that the firm has no consumer data privacy policy. She asks you if you feel that creation of such a policy is a priority. What do you say?