Data Privacy CRAGE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A hospital is deploying an AI system that predicts patient deterioration using electronic health records (EHRs). The system will be developed by an external vendor and hosted on the vendor's cloud infrastructure. The hospital's legal team requires a privacy impact assessment (PIA) before deployment. The vendor claims that the data will be pseudonymized and that differential privacy will be applied. The hospital's data protection officer (DPO) is concerned about the vendor's ability to re-identify patients. Which action should the DPO take?

   • ARequire the vendor to sign a data processing agreement and conduct a PIA that includes a re-identification risk assessment.
   • BAccept the vendor's pseudonymization and differential privacy as sufficient without further assessment.
   • CProhibit the use of the vendor's cloud and require on-premises deployment.
   • DAsk the vendor to anonymize the data completely before processing.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A healthcare startup wants to share patient records with a research partner to train a diagnostic AI model. The records include names, dates of birth, and detailed clinical notes. The startup's legal team says the data must be truly anonymized to avoid GDPR obligations. Which approach best meets this requirement?

   • AApply k-anonymity to the dataset so that each combination of quasi-identifiers appears at least k times.
   • BUse differential privacy to add calibrated noise to the dataset before sharing.
   • CRemove all direct identifiers and apply a robust risk assessment to confirm that re-identification is not reasonably likely.
   • DReplace names and dates of birth with random identifiers and remove direct identifiers from the clinical notes.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which organizational role is typically responsible for overseeing data protection strategy and ensuring compliance with privacy regulations?

   • AChief Financial Officer (CFO)
   • BData Protection Officer (DPO)
   • CMachine Learning Engineer
   • DChief Information Security Officer (CISO)
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   An AI system uses customer data to personalize content. A customer requests deletion of their data. The system also uses the data to train a model that is already in production. The company cannot easily retrain. What is the most appropriate response?

   • AIgnore the request because the data is part of a trained model and no longer considered personal data.
   • BDelete the customer's raw data from all systems, document the request, and note that the model's training data cannot be retroactively removed.
   • CRetrain the model immediately to remove the customer's influence, even if it takes months.
   • DAnonymize the customer's data in the training set and inform them that the request is fulfilled.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which approach best exemplifies 'Privacy by Design' in the development of an AI system?

   • AConducting a privacy audit only when required by law.
   • BUsing encryption only for data stored in the cloud.
   • CAdding a privacy policy page to the system after deployment.
   • DIntegrating privacy features into the system architecture from the initial design phase.
   Reveal Solution Discussion Select an answer first