SCENARIO
Please use the following to answer the next question:
Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.
The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.
LBH’s privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.
The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.
What is the best way to minimize the risk of an exposure violation through the use of the app?

1. A. Prevent the downloading of photos stored in the app.
2. B. Dissociate the patient health data from the personal data.
3. C. Exclude the collection of personal information from the health record.
4. D. Create a policy to prevent combining data with external data sources.

Correct Answer: D

What is the best way to protect privacy on a geographic information system (GIS)?

1. A. Limiting the data provided to the system.
2. B. Using a wireless encryption protocol.
3. C. Scrambling location information.
4. D. Using a firewall.

Correct Answer: A

In order to prevent others from identifying an individual within a data set, privacy engineers use a cryptographically-secure hashing algorithm. Use of hashes in this way illustrates the privacy tactic known as what?

1. A. Isolation.
2. B. Obfuscation.
3. C. Perturbation.
4. D. Stripping.

Correct Answer: B

How can a hacker gain control of a smartphone to perform remote audio and video surveillance?

1. A. By performing cross-site scripting.
2. B. By installing a roving bug on the phone.
3. C. By manipulating geographic information systems.
4. D. By accessing a phone's global positioning system satellite signal.

Correct Answer: B

An organization based in California, USA is implementing a new online helpdesk solution for recording customer call information. The organization considers the capture of personal data on the online helpdesk solution to be in the interest of the company in best servicing customer calls.
Before implementation, a privacy technologist should conduct which of the following?

1. A. A Data Protection Impact Assessment (DPIA) and consultation with the appropriate regulator to ensure legal compliance.
2. B. A privacy risk and impact assessment to evaluate potential risks from the proposed processing operations.
3. C. A Legitimate Interest Assessment (LIA) to ensure that the processing is proportionate and does not override the privacy, rights and freedoms of the customers.
4. D. A security assessment of the help desk solution and provider to assess if the technology was developed with a security by design approach.

Correct Answer: C