Objective 3.1 Identify and Mitigate Privacy Risks CERTIFIED-ETHICAL-EMERGING-TECHNOLOGIST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A ride-sharing company collects real-time location data from drivers and passengers. The company wants to use this data to improve route optimization and provide personalized recommendations. However, the company is concerned about the privacy risks of collecting and storing precise location data. The company wants to reduce the risk of misuse while still using the data for its intended purposes. Which mitigation strategy would best balance these goals?

   • AEncrypt all location data stored in the database.
   • BCollect location data at a reduced granularity (e.g., city-level instead of street-level) for non-critical features.
   • CObtain explicit consent from users for the collection of precise location data.
   • DImplement a data loss prevention system to monitor access to location data.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A social media company is planning to share user data with a third-party research institute for a study on online behavior. The data includes user posts, friend connections, and location check-ins. The company is concerned about the risk of re-identification and the potential for the research institute to misuse the data. The company wants to share the data in a way that minimizes privacy risks while still allowing the research to be conducted. Which approach would best achieve this?

   • AShare the raw data with the research institute but require them to sign a non-disclosure agreement.
   • BAnonymize the data by removing all user posts and friend connections.
   • CShare a de-identified dataset with the research institute under a strict data-sharing agreement that limits use and requires data destruction after the study.
   • DEncrypt the data and provide the research institute with the decryption key.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a privacy risk arising from data processing?

   • AAnonymizing data before analysis
   • BUsing personal data for a purpose that was not disclosed to the data subject
   • CAppointing a data protection officer (DPO)
   • DDeleting personal data after the retention period expires
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A healthcare analytics company receives patient data from multiple hospitals for research. The data includes diagnosis codes, treatment histories, and dates of service. The company wants to share aggregated insights with pharmaceutical partners but is concerned about re-identification risks. The legal team requires that the company minimize the risk of re-identification while preserving the utility of the data for research. Which approach best balances these competing requirements?

   • AObtain consent from all patients whose data is in the dataset.
   • BRemove all diagnosis codes and treatment histories from the dataset.
   • CEncrypt the dataset and share the encryption key with the pharmaceutical partners.
   • DApply k-anonymity to the dataset by generalizing quasi-identifiers such as dates of service and diagnosis codes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services firm stores customer records in a shared network drive. An internal audit reveals that any employee can access all customer files, including those unrelated to their role. The firm needs to reduce the risk of unauthorized access. Which mitigation strategy should be implemented first?

   • AAnonymize all customer records stored on the drive.
   • BEncrypt the entire network drive with full-disk encryption.
   • CDeploy a data loss prevention system to block file transfers.
   • DImplement role-based access controls so employees only see data required for their job function.
   Reveal Solution Discussion Select an answer first