Data Privacy CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A government agency is developing an AI system that uses citizens' data to predict eligibility for social benefits. The agency must conduct a Privacy Impact Assessment (PIA). At which stage of the project should the PIA be initiated?

   • AWhen the system is fully operational, to evaluate compliance with regulations.
   • BAfter the system is deployed, to assess actual privacy impacts.
   • CBefore the system is built, during the design phase, to identify and mitigate privacy risks early.
   • DOnly if a data breach occurs, to document the impact.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A research institute wants to share a dataset of patient records with external collaborators for a study. The dataset includes names, addresses, and medical conditions. The institute wants to minimize re-identification risk while preserving data utility. Which approach is most appropriate?

   • AReplace names and addresses with random identifiers and apply k-anonymity to the medical condition fields.
   • BEncrypt the entire dataset and share the encryption key with collaborators.
   • CApply differential privacy to the entire dataset before sharing, ensuring zero risk of re-identification.
   • DRemove names and addresses and share the remaining data as-is, since it is no longer personal data.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Under the GDPR, which of the following is a core requirement for AI systems that process personal data?

   • AAppointing a Data Protection Officer (DPO) for every organization that uses AI.
   • BObtaining a license from the European Data Protection Board before deploying any AI model.
   • CStoring all personal data on servers located within the European Union.
   • DConducting a Data Protection Impact Assessment (DPIA) when processing is likely to result in a high risk to individuals' rights and freedoms.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A smart city project plans to deploy AI-powered cameras to manage traffic flow. The system will collect video footage of pedestrians and vehicles. The city council wants to ensure privacy by design. The vendor proposes to store all footage for 30 days and use it for future AI training. The privacy officer suggests a different approach. Which approach best aligns with privacy by design?

   • ABlur faces and license plates in the footage before storing it.
   • BStore all footage for 30 days and restrict access to authorized personnel only.
   • CProcess video footage in real-time to detect traffic patterns, and store only aggregated, anonymized statistics instead of raw footage.
   • DStore all footage for 30 days and obtain consent from all individuals captured.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A large enterprise is deploying multiple AI systems that process personal data. The DPO wants to ensure ongoing compliance and accountability. Which organizational measure is most effective?

   • ARely on the legal department to review each AI model after deployment.
   • BPurchase cyber insurance to cover potential privacy breaches.
   • CConduct a one-time privacy training for all employees.
   • DEstablish a data governance committee that reviews AI projects at key lifecycle stages and maintains a record of processing activities.
   Reveal Solution Discussion Select an answer first