Building Privacy, Trust, and Safety in AI Systems CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A technology company is developing a new AI-powered personal assistant that will be used in homes. The assistant will record audio to respond to voice commands. The company wants to apply Privacy by Design, but there is a conflict: the assistant's functionality improves with more audio data, but privacy principles require data minimization. The product team must decide how to handle audio data. Which approach best resolves the conflict between functionality and privacy?

   • AProcessing audio locally on the device to extract only the necessary command data, and sending only that extracted data to the cloud for further processing.
   • BObtaining broad consent from users to record and store all audio data.
   • CAnonymizing all audio data before processing, but still storing it indefinitely.
   • DRecording and storing all audio data in the cloud to improve the assistant's accuracy over time.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A bank is using an AI system to detect fraudulent transactions. The system has a high detection rate but also produces false positives, which can inconvenience customers. The bank wants to maintain customer trust while minimizing fraud losses. Which approach best balances these competing needs?

   • AAutomatically block all transactions flagged by the system without any human review to ensure no fraudulent transactions are missed.
   • BImplement a human-in-the-loop review process for transactions flagged as fraudulent, allowing the system to explain its reasoning to a human analyst.
   • CIncrease the system's sensitivity to catch more fraud, even if this leads to more false positives.
   • DReduce the system's sensitivity to minimize false positives, even if this means some fraudulent transactions are missed.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A tech company is developing an AI assistant for elderly care. The assistant can remind users to take medication, detect falls, and alert emergency services. The company wants to build trust with users and their families. However, there is a trade-off between the assistant's autonomy (e.g., automatically calling emergency services) and user control (e.g., requiring user confirmation before calling). Which approach best balances autonomy and user control to build trust?

   • AImplement a tiered alert system where the assistant automatically calls emergency services for critical situations (e.g., detected fall with no response) but requires user confirmation for non-critical alerts (e.g., medication reminders).
   • BAllow the assistant to act autonomously for all actions, including medication reminders, to reduce the burden on the user.
   • CRequire user confirmation for all actions, including emergency calls, to ensure the user has full control at all times.
   • DDisable the assistant's ability to call emergency services and rely on the user to call for help.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital is implementing an AI system that predicts patient deterioration. The system will use patient vital signs and medical history. The hospital must conduct a Data Protection Impact Assessment (DPIA) because the processing is likely to result in a high risk to individuals' rights and freedoms. Which step is essential in the DPIA process?

   • APublishing the DPIA report on the hospital's public website to ensure transparency.
   • BDeferring the DPIA until after the system is deployed to avoid delaying implementation.
   • CConsulting with relevant stakeholders, including data protection officers, clinicians, and patient representatives, to gather diverse perspectives on risks and mitigations.
   • DLimiting the DPIA to a review of the AI model's accuracy metrics.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services company is deploying an AI system that analyzes customer transaction data to detect fraudulent activity. The system will process personal financial data, and the company must comply with data protection regulations. As part of the Data Protection Impact Assessment (DPIA), the team identifies that the system collects more customer data than necessary for fraud detection. The team also notes that the data is retained for longer than needed. Which combination of actions best addresses the DPIA findings and aligns with the principles of data minimization and purpose limitation?

   • AAnonymize all data before processing, and keep the data for as long as the model is in use.
   • BIncrease the data collected to improve model accuracy, and store data indefinitely for future analysis.
   • CObtain broad consent from customers for all data processing, and retain data for a fixed 10-year period.
   • DReduce the data fields collected to only those essential for fraud detection, and set a retention period that deletes data once it is no longer needed for that purpose.
   Reveal Solution Discussion Select an answer first