An EU marketing company is planning to make use of personal data captured to make automated decisions based on profiling. In some cases, processing and automated decisions may have a legal effect on individuals, such as credit worthiness. When evaluating the implementation of systems making automated decisions, in which situation would the company have to accommodate an individual's right NOT to be subject to such processing to ensure compliance under the General Data Protection Regulation (GDPR)?
Answer(s): B
Why option B is the correct choiceArticle 22 GDPR obliges a controller to “make available to the data subject meaningful information about the logic involved” and to “enable the data subject to obtain human intervention” when a decision is automated and it has legal or similarly significant effects on the individual. If no human intervention or meaningful oversight occurs, the safeguards provided by Article 22(3) are not triggered, so the data subject’s right not to be subject to such processing must be respected unless the processing falls under a specific exception (e.g., consent with safeguards, contractual necessity with right to contest). Therefore, when the decision-making is fully automated, the company must accommodate the object-to-automated-processing right to avoid a GDPR breach.Why the other options are less suitableOption A – If a decision does not affect legal status or rights , Article 22’s strict safeguards are not mandatory; the right may be optional, so processing can continue without a mandatory accommodation. Option C – Explicit consent can legitimize profiling, but the GDPR still requires “appropriate safeguards” and the data subject must retain the right to withdraw consent or request human review. Consent alone does not automatically dispense with the right to object when the processing is high-risk or has significant effects. Option D – Necessity for contract formation may be a lawful basis, yet the data subject retains the right to contest the automated decision and to obtain human intervention, meaning the company must still accommodate the right unless the contestability condition is fully satisfied.
European Data Protection Board, Guidelines on Automated Individual Decision-Making, 2020 –https://edpb.europa.eu/clarification/2020/05/automated-individual-decision-making_en.pdf Official Journal of the European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), Art. 22 – https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationThe app is designed to collect and transmit geolocation data How can data collection best be limited to the necessary minimum?
The most appropriate way to limit geolocation collection is to grant access and share the data only after an accident has been confirmed (Option B).This approach enforces the purpose-limitation principle: geolocation is harvested solely when it is needed to process a claim arising from a collision, rather than continuously for every user session. It aligns with the data-minimization requirement of privacy frameworks such as the AICPA/CIPP and GDPR, ensuring that only the minimal set of location data necessary for claim validation is collected. By tying data capture to the occurrence of an accident, the system automatically restricts the scope, duration, and volume of location information, reducing exposure and unnecessary risk.Why the other options are less suitableA: Allow user to opt-out at any time – Opt-out does not prevent continuous collection; users may inadvertently remain tracked, and the system still retains full-time location data, violating the minimization objective. C. Present a clear and explicit explanation about the need for the data – Transparency is essential, but an explanation alone does not curb the amount or timing of collection; the data may still be gathered continuously, which does not meet the “minimum necessary” criterion. D. Obtain consent and capture data at all times after consent – Consent does not eliminate indiscriminate collection; storing location continuously after consent still exceeds what is strictly required for a claim, contravening data-minimization.Thus, Option B best satisfies the principle of collecting only the data indispensable for the specific claim-processing purpose.
AICPA/CPA Canada – Trust Services Criteria for Data Privacy ( https://www.aicpa.org/content/documents/training/aicpa/cpa/privacy/TS-Data-Privacy.pdf ) European Union Agency for Cybersecurity (ENISA) – Guidelines for Data Minimization in Mobile Applications ( https://www.enisa.europa.eu/publications/data-minimization-mobile-apps )
SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:First and last nameDate of birth (DOB)Mailing addressEmail addressCar VIN numberCar modelLicense plateInsurance card numberPhotoVehicle diagnosticsGeolocationAll of the following technical measures can be implemented by EnsureClaim to protect personal information that is accessible by third-parties EXCEPT?
Answer(s): C
Why option C (De-identification) is the correct “EXCEPT” answerEncryption protects data at rest and in transit, ensuring that any party that accesses the data (including third-party hosts) cannot read it without the decryption key. Access Controls enforce who – and under what conditions – can connect to the systems that store or process the data, limiting exposure to authorized personnel only. Multi-factor authentication (MFA) adds a strong verification step for any user (including internal staff and external integrators) attempting to reach systems that contain personal information, reducing the risk of credential theft. De-identification is a process that removes or masks direct identifiers from data before it is stored or transmitted. Once the data has been handed to a third-party host, the host still receives the raw records; de-identification does not limit the third-party’s ability to access the original, identifiable fields. In other words, it is not a technical safeguard that protects data while it is accessible by a third party; it merely alters the data’s form beforehand.Therefore, among the listed options, de-identification is the only technique that does not constitute a technical measure specifically aimed at protecting personal information that is already accessible to third parties.
NIST Special Publication 800-53 Revision 5 – Security and Privacy Controls for Information Systems and Organizations, controls related to encryption, access control, and authentication. IAPP “Privacy Technologist Body of Knowledge” – discussion of de-identification vs. technical safeguards in the context of data sharing.
SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:-First and last name-Date of birth (DOB)-Mailing address-Email address-Car VIN number-Car model-License plate-Insurance card number-Photo-Vehicle diagnostics-GeolocationWhat IT architecture would be most appropriate for this mobile platform?
JustificationClient-Server architecture (Option B) is the most appropriate because the mobile app functions as a thin client that sends user-generated data (photos, diagnostics, location, personal identifiers) to a centralized backend hosted by the third-party provider. This model supports:Secure, authenticated transmission of sensitive PII to a governed storage tier. Centralized data-management policies (access control, retention, encryption) required for privacy compliance. Scalability and maintenance of a single source of truth for claim adjusters and customer-service staff. Clear separation of concerns: the client handles UI and data capture; the server handles validation, storage, and distribution of that data.Peer-to-peer (Option A) would expose the collected data directly between devices, making it impractical to enforce consistent privacy controls, audit trails, or secure storage , which is essential for personal health-related and vehicle-identifying information.Plug-in-based architecture (Option C) describes adding optional modules to an existing application framework but does not address the core communication topology needed for multi-user data sharing, so it does not answer the architectural question.Service-oriented architecture (Option D) can coexist with a client-server model, but on its own it does not specify how the mobile client interacts with back-end services. In practice, the mobile platform still relies on a client-server interaction to invoke those services, making option B more directly aligned with the scenario’s requirements.Conclusion: The client-server model best meets the technical and privacy demands of collecting, transmitting, and centrally reviewing highly sensitive claim-related data from a mobile application.
AWS Mobile Application Architecture Overview – https://aws.amazon.com/architecture/mobile-application-architecture/ Google Cloud Best Practices for Mobile Backend Services – https://cloud.google.com/architecture/mobile-backend
SCENARIOPlease use the following to answer next question:EnsureClaim is developing a mobile app platform for managing data used for assessing car accident insurance claims. Individuals use the app to take pictures at the crash site, eliminating the need for a built-in vehicle camera. EnsureClaim uses a third-party hosting provider to store data collected by the app. EnsureClaim customer service employees also receive and review app data before sharing with insurance claim adjusters.The app collects the following information:-First and last name-Date of birth (DOB)-Mailing address-Email address-Car VIN number-Car model-License plate-Insurance card number-Photo-Vehicle diagnostics-GeolocationWhat would be the best way to supervise the third-party systems the EnsureClaim App will share data with?
Why option B is the best choiceConducting a dedicated security-and-privacy review before any third-party is onboarded ensures that the vendor’s data-handling practices are examined against the app’s specific data set (PII, location, VIN, health-related diagnostics, etc.).The review can verify that the contractor has implemented appropriate technical (encryption, access controls, logging) and organisational (training, incident-response) safeguards, and that contractual clauses (e.g., DPAs, SCCs) reflect the required level of protection. This proactive assessment aligns with certification standards such as the CIPP/E /CIPP/IT competencies for vendor-risk management and satisfies regulatory expectations (e.g., GDPR Art. 32, CCPA “reasonable security measures”).Why the other options are less suitableOption A – Review privacy notices onlyA notice is just a legal statement; it does not guarantee that the third-party actually implements the described controls. It overlooks technical safeguards, data-flow mapping, and contractual obligations, leaving a material risk unaddressed.Option C – Anonymize all personal data before sharingCertain data elements (photos of the crash site, VIN, insurance card numbers) are inherently identifiable and may not be fully anonymizable without losing analytical value. Anonymisation also does not replace the need to vet the third-party’s security posture; it merely masks data after collection.Option D – Develop policies for data sharingPolicies are essential, but they must be backed by concrete due-diligence before a vendor is accepted. Relying solely on policy without an upfront security-privacy review can result in uncontrolled exposure, inconsistent enforcement, and gaps in the organization’s risk-management framework.
IAPP, Data Processing Agreements (DPAs) – Best Practices – https://iapp.org/resources/data-processing-agreements-best-practices/ NIST, Privacy Framework – https://www.nist.gov/privacy-framework (accessed 2025)
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.