Privacy and Data Governance Programs AAIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare AI vendor is developing a new patient-risk prediction model. The development team plans to use a large clinical dataset that includes patient names, dates of birth, and diagnostic codes. The privacy officer insists that privacy protections be embedded into the system's architecture from the initial design phase rather than added after deployment. Which action best aligns with the privacy by design principle in this scenario?

   • AApply data minimization by using only the diagnostic codes and de-identified patient records for model training.
   • BConduct a Privacy Impact Assessment after the model is deployed to identify any residual risks.
   • CObtain broad patient consent for all future research uses of the dataset during the consent process.
   • DRely on the existing data governance committee to review the dataset after the model is in production.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's AI-powered recruitment system has suffered a data breach. An attacker exfiltrated a database containing candidate resumes, including names, contact details, and employment history. The company's security team has confirmed the breach and contained it. What is the company's most immediate next step under GDPR?

   • ADocument the breach, including its facts, effects, and remedial actions taken, and notify the supervisory authority within 72 hours if required.
   • BWait for the law enforcement investigation to conclude before taking any action.
   • CImmediately delete all candidate data from the recruitment system to prevent further exposure.
   • DNotify the affected candidates as soon as possible, regardless of the risk level.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key benefit of maintaining a data inventory for an AI system?

   • AIt automatically enforces data retention policies.
   • BIt enables the organization to identify all personal data processed by the system.
   • CIt eliminates the need for data classification.
   • DIt guarantees that the AI system is compliant with all privacy regulations.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best exemplifies the principle of 'privacy by default' in an AI system?

   • AThe system collects only the minimum personal data necessary for its intended purpose.
   • BThe system allows users to opt out of data collection after they have been informed.
   • CThe system is designed to be transparent about its data processing activities.
   • DThe system uses encryption to protect data in transit and at rest.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key component of an effective privacy training program for AI developers?

   • AMaking training optional for senior developers.
   • BFocusing only on legal compliance without practical application.
   • CTeaching developers about privacy principles and how to apply them in AI system design.
   • DProviding training only once during onboarding.
   Reveal Solution Discussion Select an answer first