A cloud provider would like to use information on one of their cloud customers for advertising purposes. Before they can do this, they must get explicit permission from the cloud customer to do so. Which key principle of ISO/IEC 27018 does this scenario fall into?