Data Privacy CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An AI system collects only the user attributes that are strictly necessary to perform its intended function and retains them only for as long as needed. Which privacy principle is being applied?

   • APurpose limitation
   • BData security
   • CData minimization
   • DStorage limitation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An online retailer uses an AI recommendation system that stores customer purchase history. A customer requests a copy of all personal data the company holds about them. Which action best fulfills the data subject's right of access?

   • ARefuse the request because the data is used for AI recommendations and is not in a human-readable format.
   • BProvide a summary of the data, but not the actual data, to protect trade secrets.
   • CProvide only the purchase history, excluding any profile data because it is generated by the AI.
   • DProvide a copy of the customer's purchase history and any derived profile data used for recommendations, in a structured, machine-readable format.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A startup is building a smart home device that collects audio data to improve voice recognition. The team is debating whether to collect all audio continuously or only when the device detects a wake word. Which approach best aligns with data privacy principles?

   • ACollect all audio but encrypt it before storage.
   • BCollect audio only after the wake word is detected and process it locally on the device when possible.
   • CCollect all audio continuously to improve the model's accuracy.
   • DCollect all audio and ask users to consent to the collection.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A software company is developing a new AI-powered personal assistant. The product team wants to collect voice recordings to improve speech recognition. The legal team requires privacy by design. Which design choice best embodies privacy by design?

   • AProcess voice recordings locally on the device and only send anonymized transcripts to the cloud for model improvement.
   • BCollect voice recordings but encrypt them at rest and in transit.
   • CCollect all voice recordings and store them in the cloud for future model training.
   • DCollect voice recordings and allow users to opt out of sharing them with third parties.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Under the GDPR, which of the following is a data subject right?

   • AThe right to demand that the data controller share profits from data processing.
   • BThe right to access the personal data of other data subjects.
   • CThe right to request the deletion of personal data (right to erasure).
   • DThe right to require the data controller to use the data for any purpose the data subject chooses.
   Reveal Solution Discussion Select an answer first