Data Minimization CDPSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is data minimization considered important in privacy and data protection?

   • AIt ensures that all personal data is stored in a single centralized database
   • BIt allows organizations to collect as much data as possible for future analysis
   • CIt eliminates the need for data security controls and encryption
   • DIt reduces the risk of data breaches and limits the impact of a breach if one occurs
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A privacy team has implemented a data minimization program that includes regular audits of data retention and deletion practices. The team wants to identify areas for improvement. Which approach would provide the most useful information for improving the program?

   • ASurvey employees about their understanding of the data minimization policy.
   • BCompare the actual retention periods of data assets against the documented retention schedule, and investigate any discrepancies.
   • CMeasure the total amount of data stored in the organization's data centers.
   • DReview the number of data subject access requests received in the past year.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A fitness tracking company collects users' heart rate data to provide health insights. The company later decides to use the same heart rate data to sell targeted advertisements to users. The original purpose was clearly stated as health insights only. Which action should the company take to comply with purpose specification and data minimization?

   • AUse the data for advertising because it is the same data already collected.
   • BAnonymize the heart rate data before using it for advertising.
   • CObtain explicit consent from users for the new advertising purpose before using the data for that purpose.
   • DDelete the heart rate data and collect new data specifically for advertising.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which legal framework requires businesses to limit the collection of personal information to what is 'reasonably necessary' for the purposes for which it is collected?

   • AFamily Educational Rights and Privacy Act (FERPA)
   • BCalifornia Consumer Privacy Act (CCPA)
   • CGramm-Leach-Bliley Act (GLBA)
   • DChildren's Online Privacy Protection Act (COPPA)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A multinational e-commerce company operates in the EU and California. Its website currently asks all visitors for their full name, phone number, and home address at checkout, even though the company only needs the shipping address for physical goods and an email for digital receipts. The company wants to align with GDPR and CCPA requirements. Which change should the company implement?

   • ACollect the same data but store it in a pseudonymized format to reduce privacy risk.
   • BKeep the current fields but add a checkbox that allows users to opt out of providing their phone number.
   • CCollect the same data but only for EU and California residents, and not for other customers.
   • DCollect only the data necessary for the transaction: shipping address for physical goods and email for digital receipts, and make additional fields optional.
   Reveal Solution Discussion Select an answer first