Data Minimization CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A company collects customer email addresses for order confirmations. Later, it uses those email addresses to send marketing newsletters without obtaining additional consent. Which principle is being violated?

   • AData minimization
   • BPurpose specification
   • CData retention
   • DData accuracy
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A non-profit organization runs a donation platform. The platform currently asks donors for their full name, home address, phone number, and email address. The organization only needs the donor's name and email to send receipts and thank-you messages. Which change best reflects the principle of data minimization?

   • AKeep the current form but delete the data after one year.
   • BKeep the current form but store the data in an encrypted database.
   • CModify the donation form to request only the donor's name and email address, and make the other fields optional.
   • DKeep the current form but add a checkbox that donors can select to receive fewer emails.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which technique replaces direct identifiers (e.g., name, email) with artificial identifiers to reduce identifiability while still allowing data to be linked for analysis?

   • ATokenization
   • BAnonymization
   • CEncryption
   • DPseudonymization
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A software-as-a-service (SaaS) company provides a project management tool. The company shares user data with a subcontractor that provides customer support. The subcontractor needs access to user names and email addresses to respond to support tickets. The company is considering sharing the entire user database with the subcontractor to simplify the integration. Which action best aligns with data minimization in third-party management?

   • AShare the entire user database but pseudonymize the data before sharing.
   • BShare the entire user database with the subcontractor because they are bound by a data processing agreement.
   • CShare the entire user database but require the subcontractor to delete it after each support ticket is resolved.
   • DProvide the subcontractor with access only to the user names and email addresses of users who have open support tickets, and include a contractual clause that limits the subcontractor's use of the data to support purposes.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A mobile banking app is being redesigned. The product team wants to collect the user's location data to offer personalized branch recommendations. The app's core functionality is banking transactions, which does not require location data. The privacy team wants to apply data minimization. Which approach should the team take?

   • ACollect location data by default and use it for both branch recommendations and fraud detection.
   • BCollect location data by default but allow users to turn it off in the settings.
   • CCollect location data by default but anonymize it before storing.
   • DDo not collect location data by default, and only collect it if the user explicitly opts in for the branch recommendation feature.
   Reveal Solution Discussion Select an answer first