Data Privacy CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company operating in California and the EU wants to ensure its AI chatbot complies with both CCPA and GDPR. The chatbot collects user queries and personal data. Which action is most important for compliance with both regulations?

   • AProvide users with a clear privacy notice that explains data collection, purpose, and their rights under both regulations.
   • BStore all user data in the EU to avoid CCPA obligations.
   • CObtain explicit consent from all users before collecting any data.
   • DOnly comply with GDPR because it is stricter than CCPA.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A data scientist wants to release a dataset for research. They have removed direct identifiers and applied k-anonymity with k=5. A reviewer argues that the data may still be re-identifiable. Which additional technique would most effectively reduce re-identification risk?

   • ARemove all quasi-identifiers, leaving only the target variable.
   • BEncrypt the dataset and share the key only with approved researchers.
   • CIncrease the dataset size by adding more records from other sources.
   • DApply differential privacy by adding calibrated noise to the dataset.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A mobile health app wants to train a predictive model on user data without sending raw personal data to a central server. The team is considering federated learning. Which statement best describes the primary privacy benefit of federated learning in this context?

   • AIt completely anonymizes the data before training, so no personal data is processed.
   • BIt eliminates the need for any privacy impact assessment because data never leaves the device.
   • CIt allows the model to be trained on-device, so raw personal data does not leave the user's device.
   • DIt ensures that the model never sees any personal data because only encrypted gradients are shared.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is an example of pseudonymization?

   • AAdding random noise to the data to mask individual values.
   • BReplacing names with unique random identifiers and storing the mapping table in a secure location.
   • CEncrypting the entire dataset with a strong encryption key and discarding the key.
   • DRemoving all direct identifiers and aggregating data so that no individual can be distinguished.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard · select all that apply

   A multinational company's AI system processes personal data of EU and California residents. The company must comply with both GDPR and CCPA. Which practices are required to satisfy both regulations? Select all that apply.

   • AObtain explicit opt-in consent for all data processing activities.
   • BOffer a mechanism for data subjects to request deletion of their personal data.
   • CConduct a privacy impact assessment for all AI systems.
   • DProvide a clear privacy notice that explains the categories of personal data collected and the purposes of processing.
   • EEnsure that data subject requests are responded to within the required timeframes (e.g., 30 days under GDPR, 45 days under CCPA).
   Check answers Discussion Select an answer first