Impact Assessments Flashcards
6 cards from real CDPSE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Impact Assessments flashcards as text
A healthcare organization is planning to implement a new city-wide patient portal that uses AI to predict potential health risks based on consolidated electronic health records. According to GDPR Article 35, a Data Protection Impact Assessment (DPIA) is mandatory. After conducting the DPIA, the privacy engineering team concludes that the processing would result in a high risk to patients' rights and freedoms, and they are unable to identify sufficient mitigating measures. What is the required next step?
Answer: Consult the supervisory authority prior to commencing the processing.
According to GDPR Article 36, if a Data Protection Impact Assessment (DPIA) indicates that processing would result in a high risk and the organization cannot find sufficient measures to mitigate that risk, it is mandatory to consult the relevant data protection supervisory authority before starting the processing.
A data privacy solutions engineer is embedding the Privacy Impact Assessment (PIA) process into the company's system development lifecycle (SDLC). At which stage should the PIA be initiated to be MOST effective?
Answer: During the initial design and planning phase.
To be most effective and align with the principle of 'Privacy by Design', a PIA should be initiated as early as possible in the project lifecycle. Starting during the design and planning phase allows privacy considerations to influence the system's architecture, data flows, and features, rather than retrofitting privacy controls later, which is often more costly and less effective.
Which of the following is the PRIMARY objective of conducting a Privacy Impact Assessment (PIA)?
Answer: To identify and mitigate potential privacy risks to individuals before a project is launched.
The primary goal of a PIA is to serve as a risk management tool. It systematically identifies how a new project, system, or process might negatively affect individuals' privacy and then prescribes solutions to mitigate or eliminate those risks. While it helps with compliance, its core function is proactive risk management.
A retail company is developing a new in-store analytics system using facial recognition technology to track customer traffic patterns and estimate demographics. Which of the following elements is a mandatory component of the Data Protection Impact Assessment (DPIA) for this system under GDPR?
Answer: An assessment of the necessity and proportionality of the processing operations.
GDPR Article 35(7) explicitly requires that a DPIA contain several key elements, including 'an assessment of the necessity and proportionality of the processing operations in relation to the purposes'. This involves evaluating whether the planned data processing is truly required to achieve the objective and if the privacy intrusion is justified by the benefits.
During a Privacy Impact Assessment for a new employee monitoring software, the privacy team identifies a risk of 'function creep'. Which scenario BEST illustrates this specific risk?
Answer: The software, initially approved for tracking productivity, is later used to monitor union-related activities.
Function creep (or purpose creep) occurs when personal data collected for one specific, legitimate purpose is subsequently used for a different, unstated, and often inappropriate purpose. Using a productivity tool to monitor union activities is a classic example of expanding the system's function beyond its original, stated purpose, thereby violating the principle of purpose limitation.
A privacy engineer is creating a screening questionnaire to help project managers determine if a full Privacy Impact Assessment is required for a new initiative. Which of the following questions would be MOST effective in identifying a trigger for a mandatory PIA?
Answer: Does the project introduce a new technology or a novel use of existing technology for processing personal data?
A primary trigger for conducting a PIA is when a project involves new or significantly changed ways of handling personal data, especially using new technologies. This creates uncertainty about the potential privacy impact, making a systematic assessment necessary. While the number of individuals or data retention periods are factors, the introduction of novel processing is a more direct and critical trigger.