Data Privacy CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A government agency is planning to deploy a facial recognition system for public security. The agency must conduct a privacy impact assessment (PIA) before deployment. Which step is most critical to include in the PIA?

   • AObtain consent from all individuals who might be captured by the cameras.
   • BDetermine the cheapest technology vendor for the system.
   • CAssess the necessity and proportionality of the surveillance in relation to the public security objective.
   • DEnsure the system uses the latest encryption algorithms.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   During a Privacy Impact Assessment for an AI system, which step typically comes first?

   • APublishing the PIA report to the public.
   • BDescribing the personal data flows and the purpose of processing.
   • CConsulting with data subjects about their preferences.
   • DImplementing technical measures to reduce privacy risks.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard · select all that apply

   A hospital is developing an AI system to predict patient readmission. The system will process sensitive health data. The hospital must conduct a DPIA. Which elements are required in the DPIA? Select all that apply.

   • AA description of the processing operations and the purposes of the processing.
   • BAn assessment of the risks to the rights and freedoms of data subjects.
   • CA cost-benefit analysis of the AI system.
   • DAn assessment of the necessity and proportionality of the processing.
   • EThe measures envisaged to address the risks, including safeguards and security measures.
   Check answers Discussion Select an answer first
5. 34foundation · easy

   At which stage of the AI lifecycle should privacy considerations first be integrated?

   • ADuring the initial design and data collection planning phase.
   • BOnly during model deployment.
   • COnly during model monitoring after deployment.
   • DOnly when a data breach occurs.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A multinational corporation's AI system processes personal data of EU citizens. The data is stored on servers in the US. The company wants to ensure GDPR-compliant cross-border data transfers. Which mechanism is most appropriate under current GDPR guidance?

   • AAnonymize the data before transfer, so GDPR does not apply.
   • BUse standard contractual clauses (SCCs) without any additional assessment, as they are always sufficient.
   • CRely on the EU-US Data Privacy Framework if the US entity is certified, and supplement with additional safeguards if needed.
   • DObtain explicit consent from each data subject for the transfer.
   Reveal Solution Discussion Select an answer first