3.2 Describe Approaches to Protect Corporate Data Privacy and Security in AI Systems AI-TECHNICAL-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational corporation is deploying an AI system that processes personal data of EU residents. The legal team is reviewing the deployment to ensure compliance with GDPR. The AI system uses customer purchase data to personalize marketing offers. Which GDPR requirement must the organization address?

   • AAppoint a Data Protection Officer (DPO) for all AI deployments
   • BAnonymize all customer data before using it for AI training
   • CObtain explicit consent from customers before processing their data for marketing
   • DEnsure all customer data is stored on-premises in the EU
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A technology company is building an AI system that uses employee performance data. The HR department wants to ensure that only authorized HR managers can view the training data and that their access is logged. Which combination of measures should the company implement?

   • AData minimization and anonymization
   • BEncryption at rest and data masking
   • CNetwork segmentation and a VPN
   • DRole-based access control (RBAC) and audit logging
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational bank operates in the EU and Asia. It wants to train a fraud detection model using transaction data from all regions. EU regulations prohibit transferring personal data outside the EU without adequate safeguards. The bank also needs the model to be trained on the full dataset to achieve high accuracy. The data science team proposes using federated learning. The bank's legal team is concerned that federated learning alone may not fully address GDPR requirements. Which additional measure should the bank implement to strengthen GDPR compliance?

   • AUse homomorphic encryption to encrypt the model updates
   • BApply differential privacy to the model updates before sending them to the central server
   • CObtain explicit consent from all customers for cross-border data processing
   • DStore all training data in a single EU data center
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A social media company is developing an AI model to recommend content to users. The company collects extensive user data, including browsing history, likes, and location. The data protection authority has raised concerns about the company's data collection practices. The company wants to continue improving its recommendation model while addressing the authority's concerns. Which approach best balances the need for data with privacy compliance?

   • AApply differential privacy to all user data before collection
   • BImplement data minimization by collecting only the data necessary for recommendations and applying purpose limitation to restrict use
   • CUse federated learning to train the model on user devices
   • DIncrease data collection to improve model accuracy, then anonymize the data
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A research institute is building an AI model to analyze medical images. The images contain patient identifiers in the metadata. The institute wants to use the images for research while reducing the risk of re-identifying patients. Which approach should they take?

   • AUse federated learning to train the model on each hospital's data
   • BApply differential privacy to the model outputs
   • CEncrypt the images and store them in a secure database
   • DStrip metadata and apply de-identification techniques to the images
   Reveal Solution Discussion Select an answer first