PLC Privacy by Design & Technology Compliance 2 — Questions and Answers
Question 1: What is a 'Data Protection Impact Assessment' (DPIA), and when is it required under GDPR?
- A financial audit of data protection costs, required annually
- A systematic risk assessment required before high-risk processing activities (Correct answer)
- A compliance checklist required for all new products
- An employee training record required when processing HR data
Correct answer: A systematic risk assessment required before high-risk processing activities
A DPIA is a systematic process to identify and minimize data protection risks, required under GDPR Article 35 before engaging in processing likely to result in high risk to individuals.
Question 2: Which technique involves replacing direct identifiers (like names or SSNs) with artificial identifiers while retaining the ability to re-identify the data?
- Anonymization
- Pseudonymization (Correct answer)
- Tokenization for payment data
- Data masking for display purposes
Correct answer: Pseudonymization
Pseudonymization replaces identifying fields with artificial identifiers while keeping a separate key that enables re-identification, unlike full anonymization which is irreversible.
Question 3: Under the Children's Online Privacy Protection Act (COPPA), websites and apps directed to children under 13 must obtain verifiable parental consent before:
- Allowing children to create any account
- Collecting, using, or disclosing personal information from children (Correct answer)
- Displaying any advertising to children
- Using cookies of any kind on the platform
Correct answer: Collecting, using, or disclosing personal information from children
COPPA requires verifiable parental consent before collecting, using, or sharing personal information from children under 13, as enforced by the FTC.
Question 4: What is the primary privacy concern with 'cookie walls' — requiring users to accept all cookies or be denied access to a website?
- They violate CCPA's right to opt out of sale
- They undermine the freely given nature of consent required by GDPR and state laws (Correct answer)
- They are prohibited by the CFPB's consumer financial protection rules
- They create ADA accessibility violations
Correct answer: They undermine the freely given nature of consent required by GDPR and state laws
Regulators have found that cookie walls coerce consent, making it not 'freely given' as required by GDPR and similar state privacy laws, because users have no real choice.
Question 5: Which privacy-enhancing technology (PET) allows organizations to perform computations on encrypted data without decrypting it?
- Differential privacy
- Homomorphic encryption (Correct answer)
- Secure multi-party computation
- Zero-knowledge proofs
Correct answer: Homomorphic encryption
Homomorphic encryption enables computations to be performed directly on encrypted data, producing encrypted results that, when decrypted, match the result of operations on plaintext.
Question 6: A company's mobile app collects location data continuously in the background. Under the principle of 'purpose limitation,' this practice is problematic because:
- Location data is categorically prohibited under US federal law
- The data may be used for purposes beyond what users were told at collection (Correct answer)
- Background collection always requires DPIA under COPPA
- GPS data is considered sensitive under GLBA
Correct answer: The data may be used for purposes beyond what users were told at collection
Purpose limitation requires that personal data be collected for specified, explicit purposes and not further processed in ways incompatible with those original purposes.
PLC Privacy by Design & Technology Compliance 2
What is a 'Data Protection Impact Assessment' (DPIA), and when is it required under GDPR?