Data Minimization CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software company is developing a new customer relationship management (CRM) system. The product manager wants to include a feature that automatically captures and stores the IP address and device type of every user who visits the company's marketing website, even though this data is not needed for the CRM's core function. The privacy team wants to apply privacy by design and default. Which approach should the team take?

   • ACollect the data by default and store it in a separate database with restricted access.
   • BCollect the data by default but provide a clear privacy notice explaining why it is collected.
   • CCollect the data by default but anonymize it immediately after collection.
   • DDesign the system so that IP address and device type are not collected by default, and only collected if the user explicitly opts in for a specific purpose such as analytics.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A company is designing a new customer loyalty program. To apply data collection limitation, which approach should it take?

   • ACollect a wide range of data, including purchase history and location, to enable future marketing opportunities
   • BCollect all available data at sign-up to avoid having to ask for more information later
   • CCollect data from third-party sources to enrich customer profiles without asking the customer
   • DCollect only the data fields that are essential for the program's operation, such as name and email address
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A global online retailer is updating its account registration process. The retailer operates in the EU and California. The current process requires users to provide their gender and date of birth, although these fields are not needed for the account to function. The retailer wants to comply with GDPR and CCPA. Which change should the retailer make?

   • AKeep the fields but make them optional and pre-checked to allow data collection.
   • BRemove the gender and date of birth fields from the registration form, and only collect them if the user voluntarily provides them for a specific, optional feature.
   • CKeep the fields but store them in a separate database with restricted access.
   • DKeep the fields but only for users in the EU and California, and not for other regions.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What does 'privacy by design' require when developing a new system that processes personal data?

   • APrivacy features can be added after the system is fully developed and deployed
   • BPrivacy is achieved by collecting as much data as possible to understand user behavior
   • CPrivacy considerations must be integrated into the system's architecture and development from the start
   • DPrivacy is only a concern for the legal team, not for developers
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A large organization is preparing for a privacy audit. The privacy team has discovered that several departments collect customer data independently, and there is no central record of what data is collected or where it is stored. The team wants to implement data minimization across the organization. Which first step should the team take?

   • AImmediately delete all customer data that is not currently in use.
   • BImplement a new data collection policy that limits all future data collection to email addresses only.
   • CCreate a comprehensive data inventory and data flow map that documents all personal data collected, its purpose, and its storage locations.
   • DConduct a privacy impact assessment for each department's data processing activities.
   Reveal Solution Discussion Select an answer first