Personal Information CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A financial institution is implementing a new fraud detection system. The system will analyze transaction data, including account numbers, transaction amounts, and IP addresses. The privacy team must determine which data elements are sensitive. Which classification is correct?

   • AIP addresses are sensitive because they can reveal location.
   • BAccount numbers and IP addresses are both personal information, but only account numbers are sensitive.
   • CTransaction amounts are sensitive because they reveal spending habits.
   • DAccount numbers are sensitive, but IP addresses are not personal information.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is developing a customer loyalty program. The program will collect customers' purchase history and birth dates to offer personalized discounts. The privacy team must ensure the program complies with privacy principles. Which approach best demonstrates 'privacy by design'?

   • ACollect as much data as possible to enable future marketing opportunities.
   • BCollect data and store it indefinitely for potential audits.
   • CCollect data but do not inform customers to avoid privacy concerns.
   • DCollect only the data necessary for the loyalty program and implement access controls.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following categories of data is generally considered sensitive personal information?

   • AJob title
   • BPreferred language
   • CMedical records
   • DFavorite color
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A data analytics firm receives a dataset from a client. The dataset contains customer IDs that are random numbers, transaction amounts, and dates. The firm also receives a separate mapping file that links customer IDs to names and addresses. The mapping file is stored on a secure server. How should the firm classify the transaction dataset?

   • APersonal data only if the firm actually accesses the mapping file.
   • BNon-personal data, because the firm is a processor and not the controller.
   • CPersonal data, because the mapping file allows re-identification of the customers.
   • DNon-personal data, because the customer IDs are random and do not contain names.
   Reveal Solution Discussion Select an answer first
6. 30application · easy

   A financial services company is implementing a new customer onboarding process. The form asks for the customer's name, address, social security number, and annual income. According to privacy principles, which data element requires the highest level of protection?

   • AName and address, because they directly identify the customer.
   • BSocial security number, because it is a sensitive identifier that can be used for identity theft.
   • CAnnual income, because it reveals financial status.
   • DAll data elements require the same level of protection.
   Reveal Solution Discussion Select an answer first