cipt-2-3 – AllNet Law

The purpose of the assessment is to enable you to assess the extent and depth of your knowledge of the Data Protection Law in preparation for the CIPT.

Format: Multiple Choice

Time: 15 minutes

The result will be provided immediately, with details on all questions.

Full Name

Email

A cloud service provider wants to advertise the benefits of its service by publishing information that shows how its users have interacted with the platform. It plans to publish only aggregated data to not identify its customers. What would be a best practice before publishing its aggregated data?

A. The company should review its legal basis for keeping the sales information and determine whether the customers have provided consent.

B. The company should maintain a log of its employees that accessed the database to ensure the underlying data has not been modified prior to aggregation.

C. The company should ensure its procedures for responding to information requests by customers allow it to correct any errors in the published data.

D. The company should evaluate whether publicly available or other sources of information are sufficient to reconstruct the aggregated database and identify individuals.

A utility company discovers that it is missing first names for some of its customers. It purchases householder data from a credit reference agency to obtain names and attempt to find a match in their customer database. The two companies will apply a logical rule that attributes the utility bills and assigns liability for such debts to the individual with the most active credit history at an address. What kind of privacy threat is most likely to occur based on this scenario?

A. The data could become distorted.

B. An individual’s identity could be appropriated.

C. The data could be used to identify an individual.

D. An individual could be placed under illegal surveillance.

Which of the following statements about aggregated data sets is TRUE?

A. Combining multiple partial-identifiers can lead to individuals becoming identifiable.

B. Removing names from the data set will prevent the individual from becoming identified.

C. Generalizing the date of birth to age makes this data point unattributable to an individual.

D. Disclosing the data set with no outlier data points will ensure individuals cannot be identified.

A company is developing a web-based chatbot that will ask customers to input information about preferences and hobbies to direct them to relevant products and services. Which of the following is the first step software developers should take to ensure only the data needed is collected?

A. Work with stakeholders to clearly define the project’s goals and identify which data components are necessary for success.

B. Create logs for interactions with the chatbot to confirm customers understand and appropriately respond to the chatbot’s questions.

C. Develop processes to transform collected data so that developers cannot see customer’s personal data unless necessary to perform their jobs.

D. Leverage Open Web Application Security Project (OWASP) resources to avoid common vulnerabilities and protect confidentiality of collected information.

Jack is a privacy engineer working in a bank. DevOps is enhancing the user interface of the bank’s mobile application and contemplating the use of an open-source library module for facial recognition. DevOps approached Jack for his guidance. What is the first step that Jack must take?

A. Conduct a risk/benefits analysis of the open-source software.

B. Test the open-source software in the bank sandbox environment.

C. Review and interpret the bank’s policy on the use of open-source software.

D. Contact the developer about the level of support for the open-source software.

SCENARIO II

Please use the following scenario to answer the next THREE questions.

A U.S.-based national retail store chain is looking to expand its business and has recently hired its first chief privacy officer (CPO) and a new chief marketing officer (CMO) to help it drive greater marketing efforts in a way that protects privacy.

The company already operates in several states but currently does not operate in other countries. In addition to its brick-and-mortar retail locations, the company has a website where people are able to order items for home delivery.

The CPO has been asked to review the company’s existing practices related to personal data and to remediate any significant issues they identify. One of the first areas that the CPO reviewed was practices related to marketing to existing and potential customers.

The organization used to rely on non-personalized marketing techniques, such as TV and radio advertising and physical billboards, as well as personalized marketing to individuals who have joined their loyalty program. The new CMO is looking to develop and deliver more personalized marketing experiences using personal data to target specific groups and individuals, with the goals of increasing both the customer base and increasing the total amount that existing customers spend per year.

The CMO meets with the CPO and relays that the marketing team has several analyses they would like to run to assist with the marketing efforts:

First, they would like to identify potential new store locations to meet the needs of online customers who might prefer to shop in-person. The sites must meet the following criteria: (a) they do not have an existing store within 20 miles, and (b) there are a minimum number of people with similar demographics to their existing customers. Before they commence this analysis, they would like to gain a baseline understanding of where their current online customers live.

Second, the CMO would like to run a joint marketing campaign with another company. To do this, they would like to identify customers the two companies have in common so they can target them for this campaign.

After the meeting, the CMO emails the CPO and tells them that as part of their analysis, the marketing team has identified an old customer dataset which has not been updated for several years and does not appear to be in use.

Which of the following should the marketing team do to understand the profile of their current customers’ locations to meet the CMO’s objective while preserving customer’s privacy?

A. Add statistical noise to the dataset using differential privacy techniques.

B. Aggregate data based on their existing online customers by abbreviated zip codes.

C. Pseudonymize their customer data set in each state and then sort by total annual spend.

D. Aggregate locational data on loyalty members who shop at their brick-and-mortar stores.

Which technique would allow the identification of regular customers to be performed in a way that does not require either company to directly share customers’ personal data with the other?

A. Both companies encrypt their customer lists using asymmetric encryption prior to sharing.

B. Both companies run each of their customers email addresses through the same hash algorithm and compare the results.

C. Both companies load the datasets into a single database and only access it through private information retrieval techniques.

D. The companies set up secure multiparty computation so that neither of them can perform the analysis without the other companies’ knowledge.

Which of the following actions could the company take with respect to the old customer data set identified by the CMO that will provide the most privacy protection?

A. Delete the dataset after confirming that there is no legal or business reason to retain it.

B. Email every customer in the dataset to ask whether they would like their data to be deleted.

C. Strip out any directly identifiable information and then make it available to the analytics team.

D. Apply access controls to restrict access to just the CMO in the event that a use case is identified.

A company has hired a marketing company to identify past website visitors who revisit its site for future marketing. This is an example of what type of activity?

A. A digital distraction.

B. A retargeting campaign.

C. A keyword ad campaign.

D. A website personalization.