Data Privacy CRAGE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best distinguishes data privacy from data security?

   • AData privacy and data security are interchangeable terms that both refer to protecting data from cyber threats.
   • BData privacy is a subset of data security that deals specifically with encryption and access controls.
   • CData security is concerned with legal compliance, while data privacy is concerned with technical safeguards.
   • DData privacy focuses on the appropriate handling and use of personal data, while data security focuses on protecting data from unauthorized access and breaches.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A global tech company has AI systems that process personal data of users in multiple jurisdictions. The company's privacy team is small and cannot conduct detailed PIAs for every AI project. The company wants to ensure compliance with GDPR and CCPA. Which approach best balances compliance and resource constraints?

   • ADevelop a risk-based prioritization framework that focuses PIA efforts on high-risk AI systems.
   • BRely on the AI vendors to conduct PIAs on behalf of the company.
   • CConduct a full PIA for every AI project, regardless of risk.
   • DSkip PIAs for projects that use pseudonymized data.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a Privacy Impact Assessment (PIA) in an AI project?

   • ATo replace the need for data security measures in the AI system.
   • BTo ensure the AI model achieves high accuracy on training data.
   • CTo identify and mitigate privacy risks associated with the processing of personal data.
   • DTo obtain consent from data subjects for all data processing activities.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mobile app developer is creating an AI-based health tracker. The app will collect sensitive health data. To comply with privacy regulations, which practice should be implemented by default?

   • ASet the app to collect only the minimum health data needed for the core feature, and require users to opt in for any additional data collection.
   • BCollect all available health data by default to improve the AI, and allow users to opt out later.
   • CCollect all data but anonymize it before storing, so privacy is protected.
   • DCollect the minimum data but share it with third parties by default for research purposes.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A marketing company collects customer email addresses for a newsletter. They also want to use the same data to train a customer segmentation AI. The customers were not informed of this secondary use. Which principle is being violated?

   • APurpose limitation, because the data was collected for one purpose and is being used for another without consent.
   • BData accuracy, because the data may not be accurate for segmentation.
   • CData security, because the data is not protected from unauthorized access.
   • DData minimization, because the company should not have collected email addresses at all.
   Reveal Solution Discussion Select an answer first