Personal Information CDPSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When is data considered non-personal?

   • AWhen it is shared with a third party
   • BWhen it is anonymized so that the individual cannot be re-identified
   • CWhen it is encrypted
   • DWhen it is stored in a cloud environment
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A data scientist at a research institute receives a dataset of patient health records. The records have been stripped of names, addresses, and social security numbers, but retain birth dates, ZIP codes, and rare medical conditions. The institute plans to publish the dataset for research. Which statement is correct regarding the dataset's classification?

   • AThe dataset is non-personal because it is used for research purposes.
   • BThe dataset is personal information because the remaining attributes could allow re-identification of individuals.
   • CThe dataset is non-personal because direct identifiers have been removed.
   • DThe dataset is sensitive personal information only if the patients have given consent for research.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A multinational company operates in a jurisdiction where biometric data is considered sensitive and requires explicit consent. The company's HR department wants to implement a fingerprint-based time-tracking system for employees. The system will store fingerprint templates locally on each employee's workstation. Which approach best balances compliance and operational needs?

   • AImplement the system, but store fingerprint templates on a central server for easier management.
   • BObtain explicit consent from each employee and store fingerprint templates locally on their workstations.
   • CUse a different biometric identifier, such as facial recognition, to avoid consent requirements.
   • DImplement the system without consent because time-tracking is a legitimate employer interest.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A company is processing data about its customers. The data includes customer names, email addresses, and purchase history. The company also processes data about its employees, including performance reviews and disciplinary records. Which statement about data subjects is correct?

   • ACustomers are data subjects, but employees are not because their data is internal.
   • BEmployees are data subjects, but customers are not because they are external.
   • CBoth customers and employees are data subjects, but the company has different obligations for each.
   • DNeither customers nor employees are data subjects because the company owns the data.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a data subject?

   • AA customer whose purchase history is stored by a retailer
   • BA third-party analytics service that processes data
   • CA data protection officer (DPO) who manages privacy compliance
   • DA retail company that collects customer data
   Reveal Solution Discussion Select an answer first