Which of the Following Items Should Be Addressed in an Organization's

Which of the following items should be addressed in an organization's privacy statement?

A) Intended use of collected information. II. Data storage and security. III. Network/infrastructure authentication controls. IV. Data retention policy of the organization. Parties authorized to access information.
B) I and II only
C) I and IV only
D) I, II, and V only
E) II, III, IV, and V only