Oversee Privacy and Security Plan PMI-CPMAI Practice Questions (Page 6)

Questions 26–29

1. 26expert · hard

   A global advertising company uses an AI model to target ads based on user behavior. The company processes data from users in the EU and California. A user from California requests to opt out of the sale of their data, and a user from the EU requests access to their data. The company must comply with both CCPA and GDPR. What is the most appropriate action?

   • AHonor the CCPA opt-out by stopping the sale of the California user's data, and honor the GDPR access request by providing the EU user with a copy of their data
   • BStop selling the data of both users to simplify compliance
   • CProvide both users with a copy of their data to satisfy both regulations
   • DIgnore the requests because the company is based outside the US and EU
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   The GDPR principle of 'data protection by design' requires that AI systems:

   • AStore all personal data indefinitely for future analysis
   • BAre deployed only after a data breach has occurred
   • CIntegrate data protection safeguards into the system's development from the initial design stage
   • DAre built using only open-source software
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When in the AI model lifecycle should a Privacy Impact Assessment (PIA) be conducted?

   • AOnly after the model has been decommissioned
   • BAnnually, regardless of any changes to the model
   • COnly when a data breach occurs
   • DBefore the model is deployed and when significant changes are made to its data processing
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A social media platform is deploying an AI moderation system that processes user-generated content, including personal messages. The platform operates globally, including in California and the EU. Before launch, the privacy team must assess risks and ensure compliance with both CCPA and GDPR. What should the team do?

   • AConduct a single Privacy Impact Assessment that covers both GDPR and CCPA requirements
   • BConduct separate PIAs for GDPR and CCPA to ensure full compliance
   • CConduct a PIA only for the EU because GDPR is stricter than CCPA
   • DSkip the PIA and rely on the legal team's review of the terms of service
   Reveal Solution Discussion Select an answer first