Data Privacy CRAGE Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   A multinational company deploys an AI-based HR analytics system that processes employee data from its EU and US offices. The EU works council requests that employees be able to access and export their personal data used by the system. The US HR team wants to use the same system to store employee performance scores. Which combination of actions best addresses the legal requirements?

   • ADeny the access request because the data is used for AI model training and is therefore exempt from GDPR access rights.
   • BAnonymize all EU employee data before storing it in the US to avoid GDPR obligations entirely.
   • CProvide a one-time CSV export to EU employees but continue storing US data without any transfer mechanism.
   • DImplement a self-service portal for EU employees to access and export their data, and rely on the company's binding corporate rules for the US data transfers.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   An insurance company is developing an AI model to predict claim fraud. The model is trained on historical claims data that includes sensitive personal data. The company wants to deploy the model in production. The privacy team has conducted a PIA and identified that the model may inadvertently memorize personal data. The team is considering several mitigation strategies. Which strategy is most effective in reducing privacy risk while maintaining model performance?

   • AUse a smaller training dataset to reduce the chance of memorization.
   • BApply differential privacy during model training to limit memorization of individual records.
   • CRegularly retrain the model with new data to reduce memorization.
   • DRestrict access to the model's predictions to authorized personnel only.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A healthcare AI vendor processes patient data from EU residents for a diagnostic model. A patient submits a request to have their data deleted from the training set. The vendor has already deployed the model and cannot retrain immediately. Which action best aligns with GDPR obligations while maintaining model integrity?

   • ARetrain the model immediately to remove the patient's influence, even though it may take months and disrupt service.
   • BDelete the patient's raw data from the source system and document the request, noting that the model's training data cannot be retroactively removed.
   • CAnonymize the patient's data in the training set and inform them that the request is fulfilled.
   • DIgnore the request because the data is part of a trained model and no longer considered personal data.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which activity is part of integrating privacy into the model deployment stage of the AI lifecycle?

   • ADeleting all training data after the model is trained.
   • BCollecting as much data as possible to improve model accuracy.
   • CPublishing the model's training data publicly for transparency.
   • DEnsuring that access controls and logging are in place to monitor who can access the model and its outputs.
   Reveal Solution Discussion Select an answer first