Privacy and Data Governance Programs AAIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A social media platform uses an AI system to personalize news feeds. The platform's privacy team is updating its user consent management process. Under GDPR, the platform must ensure that users can withdraw consent as easily as they gave it, and that the AI system stops using their data for personalization upon withdrawal. Which implementation best satisfies this requirement?

   • ARequire users to contact customer support via email to request withdrawal, and then manually update the user's profile flag.
   • BPresent a pop-up consent form every time the user opens the app, and treat any dismissal as continued consent.
   • CProvide a 'Manage Preferences' link in the user settings that allows users to toggle off personalization, and update the AI model's data pipeline to exclude that user's data from real-time inference.
   • DAllow users to delete their entire account to stop personalization, and keep their historical data for model retraining.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When a data subject withdraws consent for the processing of their personal data in an AI system, what must the organization do?

   • ARequest the data subject to provide a new lawful basis for processing.
   • BStop processing the data immediately and delete it, unless another lawful basis applies.
   • CAnonymize the data and continue processing it for the same purpose.
   • DContinue processing the data but inform the data subject that they have the right to object.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of a data classification scheme in the context of AI systems?

   • ATo ensure that data is stored in the most cost-effective storage tier.
   • BTo determine the legal basis for processing personal data.
   • CTo assign different levels of protection based on the sensitivity and criticality of the data.
   • DTo identify the data owner and data steward for each dataset.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A social media company is redesigning its AI-powered content recommendation system. The design team proposes collecting and storing user interaction data (clicks, views, time spent) indefinitely to improve the model. The privacy team insists on applying privacy by design and by default. The company's legal team notes that the lawful basis for processing is legitimate interest. What is the most appropriate design decision that balances the business need with privacy requirements?

   • ACollect all interaction data by default, but provide users with a setting to opt out of data collection for personalization.
   • BRequire users to actively opt in to data collection for personalization, and delete all data if they do not opt in.
   • CAnonymize all interaction data immediately after collection, and use only aggregated data for model training.
   • DCollect only the minimum interaction data necessary for the core recommendation function, and set a retention period that aligns with the purpose.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is evaluating a third-party vendor to provide an AI-powered chatbot for customer service. The chatbot will process customer personal data. The company's procurement team has received the vendor's security documentation. What is the most important privacy-related step for the company to take before signing the contract?

   • AConduct a vendor privacy risk assessment, including reviewing the vendor's data processing agreements and sub-processor list.
   • BAsk the vendor to sign a non-disclosure agreement (NDA) to protect the company's business information.
   • CVerify that the vendor has a privacy policy published on its website.
   • DRequire the vendor to provide a copy of its latest penetration test report.
   Reveal Solution Discussion Select an answer first