Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles Flashcards

Which privacy-enhancing technology allows a user to prove they meet a criterion (e.g., age over 18) without revealing the underlying data?

Answer: Zero-knowledge proofs

Zero-knowledge proofs let one party prove knowledge of a fact to another party without conveying any information beyond the validity of the claim.

Which data governance document formally describes what personal data an organization collects, how it is used, and with whom it is shared?

Answer: Records of processing activities (RoPA)

A Records of Processing Activities (RoPA) documents all personal data processing operations and is required under GDPR Article 30.

A healthcare app encrypts data in transit using TLS but stores it in plaintext on the server. Which threat does this configuration leave unaddressed?

Answer: Server-side data breach

Encrypting only data in transit leaves stored data vulnerable to server compromise; encryption at rest is also required.

Which US federal law specifically governs the privacy of student educational records and restricts their disclosure without consent?

Answer: FERPA

FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records and gives parents rights over those records.

Federated learning improves privacy by training machine learning models in what manner?

Answer: Training locally on devices and sharing only model updates

Federated learning keeps raw data on local devices and aggregates only model gradient updates, preventing raw data exposure.

Which concept describes the practice of collecting consent that is freely given, specific, informed, and unambiguous under GDPR?

Answer: Valid consent

GDPR Article 7 defines valid consent as freely given, specific, informed, and indicated by a clear affirmative action.

Which threat model considers the scenario where a cloud provider's employees could access customer data stored on their platform?

Answer: Insider threat model

The insider threat model accounts for risks from individuals with legitimate system access, such as employees of a cloud or SaaS provider.