Privacy-Focused Assessment (Privacy Impact Assessment) CDPSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An e-commerce company is conducting a PIA for a new recommendation engine. During data flow mapping, the team discovers that the engine will receive customer browsing history from the website, purchase history from the order database, and demographic data from a third-party data broker. The team is unsure if the data broker data is necessary for the recommendations. What is the most appropriate action during the PIA?

   • ARecommend that the data broker data be excluded from the engine unless a clear business need is demonstrated.
   • BAsk the data broker to sign a data processing agreement and proceed.
   • CInclude the data broker data in the flow and note it as a residual risk.
   • DDelay the PIA until the marketing department can justify the use of the data broker data.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A government agency is conducting a PIA for a new benefits eligibility system. The project team has completed the scoping phase and is now mapping the data flows. They have identified that the system will collect applicant financial data from a third-party database and share eligibility decisions with a separate enforcement division. What is the next step in the PIA process after the data flow mapping is complete?

   • AConsult with the enforcement division to confirm they need the eligibility decisions.
   • BDraft the final PIA report and submit it for approval.
   • CIdentify the privacy risks associated with the collection and sharing of the financial data.
   • DImplement encryption for the data in transit between the third-party database and the system.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large hospital network is conducting a PIA for a new patient data analytics platform. The platform will combine data from the EHR, wearable devices, and social determinants of health (e.g., zip code, income level) to predict patient readmission risks. The PIA team has identified a high risk of re-identification when combining these datasets. The clinical research department wants to use the platform to publish findings. The legal department is concerned about compliance with health data regulations. What is the most appropriate course of action?

   • AImplement a robust de-identification process for the combined dataset before it is used for research.
   • BAbandon the platform because the re-identification risk is too high to be acceptable.
   • CProceed with the platform but restrict the research publication to aggregate statistical results only.
   • DObtain consent from all patients whose data will be included in the platform.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a legal privacy risk?

   • AProcessing personal data without a lawful basis
   • BUsing outdated hardware for data storage
   • CReceiving negative media coverage about a product
   • DExperiencing a temporary system outage
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A city government is conducting a PIA for a new smart parking system that will use license plate recognition cameras to manage parking spaces. The system will collect license plate data and link it to payment information. The privacy team has identified a risk that the data could be used for surveillance beyond parking management. The police department has requested access to the data for law enforcement purposes. What is the most appropriate way to address this in the PIA?

   • ADeny the police department access to the data and document this decision in the PIA.
   • BAsk the police department to sign a data sharing agreement and grant access.
   • CGrant the police department access, as law enforcement needs are always a valid reason.
   • DInclude the police access as a secondary purpose in the PIA and proceed.
   Reveal Solution Discussion Select an answer first