CDPSE Enhancing Technologies 5 — Questions and Answers
Question 1: A healthcare organization needs to share patient data with a pharmaceutical researcher. The data must remain in the healthcare org's environment while the researcher runs queries. Which technology best supports this?
- Tokenization with a shared vault
- A data clean room (Correct answer)
- Pseudonymization with a public key
- Federated analytics without a trusted execution environment
Correct answer: A data clean room
A data clean room provides a controlled, neutral environment where queries can be run on data that never leaves the data owner's control, giving the researcher insights without raw data access.
Question 2: Which of the following correctly distinguishes pseudonymization from anonymization under GDPR?
- Both produce data that is no longer considered personal data under GDPR
- Pseudonymized data is still personal data under GDPR because re-identification is possible with additional information (Correct answer)
- Anonymized data retains a reversible link to the individual, unlike pseudonymized data
- GDPR treats pseudonymization and anonymization identically for compliance purposes
Correct answer: Pseudonymized data is still personal data under GDPR because re-identification is possible with additional information
GDPR Recital 26 clarifies that pseudonymized data remains personal data because it can be re-identified using separately held information, while truly anonymized data falls outside GDPR scope.
Question 3: An organization implements a system where a user's identity is split into multiple cryptographic shares distributed across independent servers, so no single server can reconstruct the identity alone. This is an example of:
- Federated identity management
- Secret sharing (e.g., Shamir's Secret Sharing) (Correct answer)
- Homomorphic identity encryption
- Decentralized pseudonymization
Correct answer: Secret sharing (e.g., Shamir's Secret Sharing)
Shamir's Secret Sharing and similar threshold schemes split a secret into shares such that only a quorum of shares (not any single one) can reconstruct the original value.
Question 4: Which PET approach would be MOST effective for a company that needs to publish a dataset for public research while ensuring that re-identification of individuals is computationally infeasible?
- Removing names and email addresses only
- Applying k-anonymity with k=2
- Combining differential privacy with generalization and suppression techniques (Correct answer)
- Replacing all dates with year-only values
Correct answer: Combining differential privacy with generalization and suppression techniques
Combining differential privacy (probabilistic re-identification resistance) with generalization and suppression provides stronger, mathematically quantifiable privacy guarantees than simple identifier removal or low-k anonymization.
Question 5: In a privacy-preserving identity verification scenario, which technology allows a user to prove they are over 18 without revealing their exact date of birth?
- Tokenization of the date of birth field
- Selective disclosure credentials using zero-knowledge proofs (Correct answer)
- Differential privacy applied to age data
- Pseudonymization of the identity record
Correct answer: Selective disclosure credentials using zero-knowledge proofs
Selective disclosure credentials with zero-knowledge proofs let users prove specific claims (e.g., age ≥ 18) derived from a credential without revealing the underlying attribute value.
Question 6: When evaluating privacy-enhancing technologies, which criterion specifically measures the degree to which the protected dataset still supports the intended analytical or operational purpose?
- Privacy budget
- Data utility (Correct answer)
- Anonymization strength
- Re-identification risk score
Correct answer: Data utility
Data utility measures how well a privacy-protected dataset preserves the accuracy and usefulness needed for its intended purpose, forming the key axis of the privacy-utility tradeoff.
Question 7: A CDPSE professional is assessing a vendor's claim that their product 'fully anonymizes' data using a proprietary algorithm with no published methodology. What is the MOST appropriate response?
- Accept the claim if the vendor provides a signed attestation
- Require the vendor to demonstrate the algorithm meets a recognized standard and allow independent verification (Correct answer)
- Assume the product is sufficient since vendors are legally liable for false claims
- Apply additional k-anonymity post-processing to compensate for uncertainty
Correct answer: Require the vendor to demonstrate the algorithm meets a recognized standard and allow independent verification
Proprietary 'black box' anonymization claims cannot be validated without transparency; the CDPSE professional should require independent verification against recognized standards such as ISO 29101 or NIST guidelines.
CDPSE Enhancing Technologies 5
A healthcare organization needs to share patient data with a pharmaceutical researcher.
The data must remain in the healthcare org's environment while the researcher runs queries.
Which technology best supports this?