Suppose a client C wants to transfer form a service provider P, who collected data on behave of C using a web-application. Additionally, suppose the amount of data is larger than 100 MByte and contains privacy related information. Thus, the data needs to be protected against third party access.
C and P operate within their own local network, both have access to the internet. The workstations and servers in C's and P's local network are assumed to be secure.
I'd like to know, which of these transfer methods is preferable and why:
Option A: Use SFTP to transfer files.
Option B: Use a simple web-application to download data directly from the web-server. Use HTTPS to protect the transport layer and a userID with a long/random password to gain privileged access. In this case, web-app would be able to dynamically export data and advertise it as a file to the browser.
Option C: Partition data into sufficiently small packets, encrypt each part with GnuPG and forward it using e-mail.
From a security point of view, are all options probably equivalent?
Or is the fact, that Option A and Option C require the creation of temporary files, less secure than just in time generation of the export file using Option B?