what is the online shop’s PRIMARY obligation while engaging in this kind of profiling?

A U.S.-based online shop uses sophisticated software to track the browsing behavior of its European customers and predict future purchases. It also shares this information with third parties. Under the GDPR,

what is the online shop’s PRIMARY obligation while engaging in this kind of profiling?
A . It must solicit informed consent through a notice on its website
B . It must seek authorization from the European supervisory authorities
C . It must be able to demonstrate a prior business relationship with the customers
D . It must prove that it uses sufficient security safeguards to protect customer data

Answer: A