DAC Data Ethics & Privacy 2 — Questions and Answers
Question 1: Which of the following is an example of a 'privacy by design' principle in data systems?
- Adding encryption after a data breach is discovered
- Building privacy safeguards into the system architecture from the start (Correct answer)
- Hiring a privacy officer after the product launches
- Publishing a privacy policy on the company website
Correct answer: Building privacy safeguards into the system architecture from the start
Privacy by design means proactively embedding privacy protections into systems and processes during the design phase, not as an afterthought.
Question 2: A company shares its customers' purchase history with a third-party marketing firm without notifying customers. This action most likely violates which ethical principle?
- Data accuracy
- Transparency (Correct answer)
- Data minimization
- Data availability
Correct answer: Transparency
Transparency requires organizations to clearly disclose how they collect, use, and share personal data; sharing data without notifying customers violates this principle.
Question 3: What is 'differential privacy' as used in data analytics?
- A technique to compare private datasets from different organizations
- A mathematical framework that adds statistical noise to datasets to protect individual privacy while allowing aggregate analysis (Correct answer)
- A method of encrypting data using different keys for different users
- A privacy law that differentiates between sensitive and non-sensitive data
Correct answer: A mathematical framework that adds statistical noise to datasets to protect individual privacy while allowing aggregate analysis
Differential privacy is a mathematical technique that injects carefully calibrated noise into query results so that individual data points cannot be identified, while still allowing meaningful aggregate statistics.
Question 4: According to GDPR, what is the maximum fine for the most serious data protection violations?
- €10 million or 2% of global annual turnover
- €20 million or 4% of global annual turnover (Correct answer)
- €50 million or 10% of global annual turnover
- €5 million or 1% of global annual turnover
Correct answer: €20 million or 4% of global annual turnover
GDPR's highest tier of fines for serious violations (such as violating core data processing principles) is up to €20 million or 4% of total global annual turnover, whichever is higher.
Question 5: A data scientist discovers their predictive model has significantly lower accuracy for minority demographic groups. What is the most ethical next step?
- Deploy the model as planned since overall accuracy is high
- Investigate the training data for bias and retrain the model with balanced representation (Correct answer)
- Report the issue only if legally required
- Exclude minority groups from the model's predictions
Correct answer: Investigate the training data for bias and retrain the model with balanced representation
Discovering disparate model performance across demographic groups requires investigating sources of bias in training data and retraining the model to ensure fair and equitable outcomes.
Question 6: Which term describes the practice of using data collected for one purpose to make decisions about individuals in an unrelated context?
- Data warehousing
- Function creep (Correct answer)
- Data deduplication
- Schema migration
Correct answer: Function creep
Function creep (also called 'scope creep') occurs when data collected for one stated purpose is later used for a different, often unintended purpose, raising serious privacy and ethical concerns.
Question 7: Which of the following best describes a 'data steward' role in an organization?
- A server administrator responsible for database backups
- An individual responsible for managing data assets, ensuring data quality, and enforcing data governance policies (Correct answer)
- A business analyst who creates data visualizations for executives
- A software engineer who writes ETL pipelines
Correct answer: An individual responsible for managing data assets, ensuring data quality, and enforcing data governance policies
A data steward is responsible for overseeing data assets within an organization, ensuring data quality, consistency, and compliance with governance policies.
DAC Data Ethics & Privacy 2
Which of the following is an example of a 'privacy by design' principle in data systems?