Objective 2.3 Follow Applicable Regulations, Standards, and Best Practices CERTIFIED-ETHICAL-EMERGING-TECHNOLOGIST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is developing a mobile app that tracks users' fitness data. The app is available in the EU and the U.S. The company wants to ensure compliance with GDPR and CCPA. Which feature is required by both regulations?

   • AObtain explicit opt-in consent before collecting any personal data.
   • BAppoint a Data Protection Officer (DPO) and conduct a Data Protection Impact Assessment (DPIA).
   • CProvide users with the right to access their personal data.
   • DProvide a 'Do Not Sell My Personal Information' link.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is considering using a new AI tool that processes personal data of EU citizens. The company's legal team is unsure whether a Data Protection Impact Assessment (DPIA) is required. Which factor most strongly indicates that a DPIA is required?

   • AThe AI tool does not store any personal data after processing.
   • BThe AI tool performs large-scale profiling that could affect individuals' rights and freedoms.
   • CThe AI tool is used only for internal administrative purposes.
   • DThe AI tool uses publicly available data only.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is implementing a new data analytics platform that will process customer data from multiple regions, including the EU and California. The company wants to adopt a single set of best practices to streamline compliance. Which approach is most effective?

   • AIgnore regulations that are not enforced in the company's home country.
   • BAdopt the highest standard among applicable regulations and apply it globally.
   • CComply with the local regulations of each region separately.
   • DUse a privacy framework like ISO/IEC 27701 as the sole compliance mechanism.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A U.S.-based health technology company is developing a wearable device that collects heart-rate and sleep data from users in California and the European Union. The product team wants to launch a single global app. Which combination of actions best addresses the applicable data protection regulations for this launch?

   • AAnonymize all health data before collection so that no regulation applies.
   • BApply HIPAA to all users, since the data is health-related, and store all data in the U.S.
   • CComply only with CCPA, because the company is U.S.-based and the data is collected from a wearable device.
   • DComply with GDPR for EU users and CCPA for California users, and implement appropriate safeguards for any cross-border data transfers.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A social media company is planning to sell user data to third-party advertisers. The company has users in California. Which requirement must the company fulfill under CCPA?

   • AObtain explicit opt-in consent from users before any data collection.
   • BAppoint a Data Protection Officer (DPO) and conduct a Data Protection Impact Assessment (DPIA).
   • CAnonymize all user data before selling it to third parties.
   • DProvide users with a clear notice at or before the point of collection, and offer a 'Do Not Sell My Personal Information' link.
   Reveal Solution Discussion Select an answer first