Certified Information Privacy Technologist: Privacy Technology and Data Protection Principles Flashcards

Which privacy principle holds that the same level of privacy protection applies whether a user is interacting anonymously or under a verified identity?

Answer: Full functionality (positive-sum)

The full functionality (positive-sum) principle rejects the false trade-off between privacy and usability, aiming to accommodate all legitimate interests.

A web application assigns a random session token instead of embedding the user's account number in the URL. This is an example of which PET?

Answer: Tokenization

Tokenization replaces sensitive values like account numbers with random tokens, reducing the exposure of real identifiers.

Under the California Consumer Privacy Act (CCPA), which right allows consumers to prevent a business from selling their personal information?

Answer: Right to opt-out of sale

The CCPA gives California residents the right to opt out of the sale of their personal information to third parties.

Which data anonymization weakness occurs when a dataset has only a few records per combination of quasi-identifiers, making individuals easy to re-identify?

Answer: Data sparsity re-identification

Data sparsity re-identification happens when rare combinations of quasi-identifiers (e.g., ZIP code, birth date, sex) uniquely or nearly uniquely identify individuals.

Which control requires that a minimum number of authorized personnel must cooperate to perform a sensitive operation, preventing unilateral action?

Answer: Multi-party authorization (M-of-N control)

M-of-N (multi-party authorization) requires M out of N designated individuals to approve an action, guarding against insider abuse.

A company automatically deletes personal data after a defined retention period using an automated policy engine. Which privacy principle does this technical control enforce?

Answer: Storage limitation

Automated deletion enforces storage limitation by ensuring personal data is not kept longer than necessary for its stated purpose.

Which term describes the risk that a machine learning model trained on sensitive data can inadvertently memorize and reveal specific training examples?

Answer: Data leakage through overfitting

Overfitted models can memorize training data, allowing adversaries to extract sensitive records through carefully crafted queries.