Data Privacy CRAGE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A consortium of hospitals wants to collaboratively train a model to detect rare diseases without sharing patient data. They are considering federated learning and homomorphic encryption. Which statement accurately describes the trade-off between these two technologies?

   • AHomomorphic encryption is always more efficient than federated learning for training models.
   • BFederated learning completely eliminates privacy risks, while homomorphic encryption does not.
   • CFederated learning reduces the need to share raw data, while homomorphic encryption allows computation on encrypted data but with high computational overhead.
   • DBoth technologies are interchangeable and provide the same level of privacy protection.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A data analytics company wants to sell a dataset of customer purchase histories to a third-party marketing firm. The dataset includes names, addresses, and purchase details. The company plans to pseudonymize the data by replacing names with unique IDs. The marketing firm wants to use the data to create targeted ads. The company's privacy officer is concerned about re-identification. Which additional measure would most effectively reduce re-identification risk?

   • ARequire the marketing firm to sign a non-disclosure agreement.
   • BApply differential privacy to the dataset before selling it.
   • CRemove addresses and replace them with ZIP codes.
   • DEncrypt the unique IDs so that only the marketing firm can decrypt them.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How can an AI system support the data subject right to data portability?

   • ABy providing the data subject's personal data in a structured, commonly used, and machine-readable format.
   • BBy providing data subjects with a summary of the AI model's decision-making process.
   • CBy allowing data subjects to delete their data from the system immediately.
   • DBy allowing data subjects to correct inaccurate personal data.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational corporation transfers employee data from its EU headquarters to a subsidiary in a country that has not been deemed adequate by the European Commission. The company has implemented standard contractual clauses (SCCs) and additional safeguards, including encryption and pseudonymization. The data protection authority (DPA) questions the effectiveness of the safeguards. What is the most appropriate response?

   • AConduct a transfer impact assessment (TIA) to evaluate the legal and practical protections in the destination country.
   • BRely on the subsidiary's certification under a privacy framework.
   • CIgnore the DPA's concerns because SCCs are a valid transfer mechanism.
   • DStop all transfers to the subsidiary immediately.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A fintech startup is building a credit-scoring AI. The product manager wants to collect as much data as possible to improve accuracy. The legal team insists on privacy by design. Which approach best balances accuracy with privacy by design principles?

   • ACollect only the data fields required for the credit model, and set the system to retain data only as long as needed for the stated purpose.
   • BCollect all data but anonymize it immediately after collection to avoid privacy obligations.
   • CCollect only required data, but store it indefinitely for future model improvements.
   • DCollect all potentially useful data now, and plan to delete it later if privacy issues arise.
   Reveal Solution Discussion Select an answer first