A security manager is asked to approve a legal interpretation of a new privacy rule. What is the best response?

1. Copy another organization's obligations unchanged
2. Ignore the issue until an incident occurs
3. Engage qualified legal counsel and translate the confirmed obligations into security requirements
4. Make a definitive legal ruling based only on technical experience