Privacy Principles (Privacy by Design, Consent, Transparency) CDPSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software company is developing a new project management tool. During the requirements phase, the team is deciding which user attributes to collect for the user profile. The sales team wants to collect job title, company size, and phone number for marketing purposes. The engineering team argues that only a username and email address are needed for the core functionality. The privacy officer wants to apply Privacy by Design from the start. Which action best demonstrates this approach?

   • ADesign the system to collect only the username and email, and plan a separate, later process to evaluate the marketing need
   • BInclude the marketing attributes but make them optional fields in the profile
   • CCollect all requested attributes now, as it is easier to remove data later than to add it
   • DDefer the decision to the post-launch phase when real user data is available
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A media streaming service is redesigning its consent interface. The current design uses a single 'Accept All Cookies' button on the first visit. The privacy team wants to implement a more compliant mechanism. Which design change best aligns with the principles of clear, granular, and easily withdrawable consent?

   • AAuto-scroll the user through a long list of individual cookie purposes, requiring a separate click for each one before proceeding
   • BKeep the 'Accept All' button but add a small, less prominent 'Manage Preferences' link in the footer of the banner
   • CProvide a 'Reject All' button that is visually equal to the 'Accept All' button, and place a link to a separate settings page where users can adjust preferences
   • DReplace the single button with a 'Cookie Settings' link that opens a menu with toggles for each category of cookies, and include 'Accept All' and 'Reject All' buttons at the top
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A user consents to a fitness app collecting their heart rate data for 'health analytics'. Six months later, the app updates its terms and wants to use the same data for 'targeted advertising'. The app sends a push notification: 'We've updated our terms. By continuing to use the app, you agree to the new data use.' The user continues using the app. Is this a valid consent for the new purpose?

   • ANo, because consent for a new purpose must be freely given, specific, informed, and unambiguous, and 'continued use' does not meet this standard
   • BYes, because the user was notified and continued to use the app, indicating acceptance
   • CNo, because the app must delete the heart rate data if the user does not explicitly agree to the new terms
   • DYes, because the user had already consented to the collection of heart rate data
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is one of the seven foundational principles of Privacy by Design?

   • APrivacy as a one-time compliance checklist
   • BPrivacy as a reactive measure to regulatory enforcement
   • CPrivacy as a user responsibility
   • DPrivacy embedded into design and architecture
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following best describes the core intent of the Privacy by Design principle 'Privacy as the Default Setting'?

   • APrivacy protections are applied only after a data breach occurs.
   • BPersonal data is protected automatically without requiring any action from the individual.
   • CIndividuals must actively opt in to privacy protections each time they use a service.
   • DThe system collects the maximum amount of personal data to improve user experience.
   Reveal Solution Discussion Select an answer first