Privacy & Data Ethics Flashcards
7 cards from real CEA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privacy & Data Ethics flashcards as text
A technology company processes biometric data to grant physical access to its facilities. Under most modern privacy frameworks, biometric data is treated as:
Answer: A special category of sensitive data requiring heightened protections
Biometric data — such as fingerprints, facial geometry, and iris scans — is classified as sensitive personal data under frameworks like GDPR and state laws like Illinois BIPA because its compromise cannot be undone.
What is 'informed consent' in the context of data collection ethics?
Answer: Agreement by a data subject who fully understands what data is collected, why, how it is used, and who it is shared with
Informed consent requires that individuals have sufficient knowledge of data practices and freely agree to them without coercion or deception.
An AI system trained on historical lending data learns to deny loans at higher rates to certain zip codes. This is an example of:
Answer: Proxy discrimination
Proxy discrimination occurs when a seemingly neutral variable — like zip code — encodes protected characteristics such as race or national origin, perpetuating historical inequities.
Which of the following actions best exemplifies the 'data minimization' principle?
Answer: Only collecting the specific data necessary for a clearly defined purpose
Data minimization means collecting only the personal data that is adequate, relevant, and limited to what is necessary for the specified purpose.
A researcher wants to study social media behavior and scrapes publicly posted content without obtaining individual consent. The primary ethical argument AGAINST this practice is:
Answer: Users did not anticipate their data being used for research purposes when they posted it
Even publicly available data carries ethical obligations; users posting in a social context did not necessarily consent to having their data extracted and analyzed for unrelated research purposes.
Under the California Consumer Privacy Act (CCPA), which right allows consumers to instruct businesses not to sell their personal information?
Answer: Right to opt-out of sale
The CCPA grants California consumers the right to opt-out of the sale of their personal information to third parties, which businesses must honor via a 'Do Not Sell My Personal Information' link.
When an organization conducts a Privacy Impact Assessment (PIA), the primary goal is to:
Answer: Identify and mitigate privacy risks before launching a new project or system
A Privacy Impact Assessment proactively identifies privacy risks and recommends safeguards during the design phase, before a system is deployed.