Privacy Principles (Privacy by Design, Consent, Transparency) CDPSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A health-tech company is developing a new wearable device. The device collects heart rate, sleep patterns, and location data. The product team wants to maximize the data collected for future research opportunities. The privacy team wants to apply Privacy by Design. The company's legal counsel notes that the primary purpose is to provide health insights to the user. Which approach best balances the product team's desire for future research with Privacy by Design principles?

   • ADelay the product launch until the research use case is fully defined
   • BCollect all data now and obtain broad consent for 'future research' to ensure no data is missed
   • CCollect all data but store it in a de-identified format so it can be used for research without consent
   • DCollect only the data necessary for the core health insights feature, and design a separate, opt-in process for users to contribute data to future research
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of a transparency practice in action?

   • AWaiting until the annual report to disclose a data breach
   • BPublishing a privacy policy only in a language most users do not understand
   • CHiding data processing practices to avoid user concern
   • DNotifying affected individuals promptly after a data breach
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When applying Privacy by Design to the lifecycle of a product, at which stage should data minimization be considered?

   • AAt every stage, from design to decommissioning
   • BOnly during the initial design phase
   • COnly when a data breach occurs
   • DOnly during the marketing and sales phase
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A city government is deploying a new smart parking system that uses sensors to detect available spots and cameras to read license plates for billing. The system is designed to process the license plate image, extract the plate number, and immediately delete the image. The plate number is stored only for the duration of the parking session. Which Privacy by Design principle is most directly demonstrated by this architecture?

   • APrivacy as the default
   • BData minimization
   • CVisibility and transparency
   • DFull functionality
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A social media platform is updating its privacy notice. The current notice is a 40-page legal document. The privacy team wants to improve transparency. Which approach best fulfills the transparency obligation?

   • ACreate a short, layered notice with a summary of key points and a link to the full legal text
   • BReplace the legal document with a short video that summarizes the data practices without providing the full details
   • CKeep the 40-page document but add a table of contents at the beginning
   • DPublish the full legal document on a separate page of the website and only link to it from the footer
   Reveal Solution Discussion Select an answer first