CDPSE - Certified Data Privacy Solutions Engineer Data Subject Rights Questions and Answers — Questions and Answers
Question 1: A data subject submits a request for data portability to an online retailer. The user has a purchase history, a wish list, and has provided explicit consent for their data to be processed for marketing purposes. Which of the following datasets is a privacy engineer required to provide in a structured, commonly used, and machine-readable format to fulfill this request?
- Only the data actively provided by the user, such as name and email address.
- All personal data related to the user, including internally generated analytics and user scores.
- The purchase history and wish list, as this is data provided by the user through their actions. (Correct answer)
- A summary of the marketing communications sent to the user.
Correct answer: The purchase history and wish list, as this is data provided by the user through their actions.
The right to data portability applies to personal data that a data subject has 'provided' to a controller. This includes not only data given explicitly (like a name) but also data generated by their activity, such as a purchase history or wish list. It does not typically apply to inferred or derived data, such as internal analytics. The response must be in a structured, commonly used, and machine-readable format like JSON or CSV.
Question 2: A data privacy solutions engineer is tasked with implementing a system to handle the 'right to erasure' (right to be forgotten). Which of the following presents the MOST significant technical challenge when ensuring complete and permanent deletion of a data subject's information?
- Removing the data from the primary production database.
- Deleting the data from marketing and communication systems.
- Ensuring the data is purged from all backup and archival systems. (Correct answer)
- Updating the user interface to reflect the data has been deleted.
Correct answer: Ensuring the data is purged from all backup and archival systems.
While deleting data from live production systems is a primary step, ensuring its complete removal from backup and archival systems presents the most significant technical challenge. Backups are often immutable or difficult to modify without compromising their integrity. A robust erasure process must have a technical solution to manage data in backups, such as overwriting it on a schedule or ensuring it's not restored, and this must be clearly communicated to the data subject. Modern enterprises often struggle with data that is duplicated across many systems, making true erasure a complex governance and architectural problem, not just a simple deletion task.
Question 3: When designing a new application that will process personal data, a privacy engineer incorporates a feature that allows users to easily download their data in a CSV format and provides granular controls over marketing preferences from the initial setup. This approach is a direct application of which fundamental privacy principle?
- Data Minimization
- Purpose Limitation
- Storage Limitation
- Privacy by Design (Correct answer)
Correct answer: Privacy by Design
Privacy by Design (PbD) is the principle of proactively embedding privacy into the design and architecture of IT systems and business practices. By building features for data subject rights (like portability) and user control directly into the application from the start, the engineer is applying PbD, rather than treating privacy as an afterthought.
Question 4: A user submits a Data Subject Access Request (DSAR) to a company. The privacy engineering team has automated the data retrieval process, which gathers data from multiple structured and unstructured sources. Before delivering the data to the user, what is the MOST critical final step the team must engineer into the process?
- Verifying the user's identity to a reasonable degree of certainty.
- Logging the request in an immutable audit trail.
- Redacting the personal data of other individuals from the collected records. (Correct answer)
- Converting the retrieved data into a proprietary encrypted format.
Correct answer: Redacting the personal data of other individuals from the collected records.
While identity verification and logging are crucial initial and ongoing steps, the most critical final step before delivery is to review and redact any personal data belonging to other individuals. Disclosing third-party personal data would constitute a data breach. A robust DSAR process must include a systematic review and redaction phase to protect the privacy of others.
Question 5: An organization receives a valid request for erasure from a former customer. However, the organization is legally required by financial regulations to retain transaction records for seven years. In this scenario, what is the appropriate technical and procedural response?
- Immediately and completely erase all data related to the customer, including financial records.
- Inform the data subject that the right to erasure does not apply and close the request.
- Erase the data that is not subject to the legal hold and inform the data subject about the data that must be retained, the legal basis for retention, and the retention period. (Correct answer)
- Anonymize all financial records immediately so they are no longer personal data.
Correct answer: Erase the data that is not subject to the legal hold and inform the data subject about the data that must be retained, the legal basis for retention, and the retention period.
The right to erasure is not absolute and is subject to exemptions, such as when data must be kept to comply with a legal obligation. The correct approach is to perform a partial deletion, erasing data that is no longer necessary while retaining the specific data required by law. The data subject must be informed about this, clarifying what data is being retained, why (the legal basis), and for how long.
Question 6: Which of the following is a primary engineering goal when implementing the right to rectification under GDPR?
- To ensure the inaccurate data is archived securely before being corrected.
- To propagate the correction to all systems and databases where the inaccurate data is stored. (Correct answer)
- To notify the data subject within 48 hours that the correction has been made.
- To log the IP address from which the rectification request was made.
Correct answer: To propagate the correction to all systems and databases where the inaccurate data is stored.
The core of the right to rectification (Article 16 of GDPR) is to ensure that inaccurate personal data is corrected. From an engineering perspective, this means the correction must be propagated across all systems, including downstream systems, backups, and archives, where the incorrect data resides to ensure its integrity and prevent further processing of inaccurate information. Failing to do so would render the correction ineffective.
CDPSE - Certified Data Privacy Solutions Engineer Data Subject Rights Questions and Answers
A data subject submits a request for data portability to an online retailer.
The user has a purchase history, a wish list, and has provided explicit consent for their data to be processed for marketing purposes.
Which of the following datasets is a privacy engineer required to provide in a structured, commonly used, and machine-readable format to fulfill this request?