D333 Ethics in Technology - Set 3 - Part 1

Correct Answer: Protecting individuals' rights over their personal data

Privacy legislation such as GDPR gives individuals rights over their personal data and imposes obligations on organizations that collect and process it.

Correct Answer: The identified or identifiable individual the personal data relates to

A data subject is the living individual whom personal data concerns. GDPR grants data subjects rights including access, rectification, erasure, and portability.

Correct Answer: The party determining the purposes and means of processing personal data

The data controller decides why and how personal data is processed and bears primary responsibility for compliance with data protection obligations.

Correct Answer: A party processing personal data on behalf of the controller

A data processor handles personal data on the controller's instructions, such as a cloud hosting provider, and has its own more limited set of legal obligations.

Correct Answer: A legal justification such as consent, contract, or legitimate interest

Privacy law requires a valid lawful basis for each processing activity, such as consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests.

Correct Answer: It must be freely given, specific, informed, and unambiguous

Valid consent requires a clear affirmative action, with specific information about the purpose, given freely and able to be withdrawn as easily as it was given.

Correct Answer: A security incident causing unauthorized access to or loss of personal data

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal data.

Correct Answer: Notifying the regulator and affected individuals within required timeframes

Many jurisdictions require notifying the supervisory authority within a set period, often 72 hours, and informing affected individuals when the risk to them is high.

Correct Answer: It denies affected people the chance to protect themselves from harm

Concealment leaves victims unable to change passwords, monitor accounts, or take protective steps, compounding the harm and breaching both ethical duty and usually legal obligation.

Correct Answer: Data that can identify a specific individual directly or indirectly

PII is any information that can identify an individual alone or combined with other data, including names, identifiers, location data, and online identifiers.

Correct Answer: Data such as health or beliefs carries higher risk of harm if misused

Special category data such as health, race, religion, or sexual orientation can lead to discrimination or serious harm if exposed, so it warrants stricter safeguards and narrower lawful bases.

Correct Answer: Data collected for one purpose should not be reused incompatibly

Purpose limitation requires that personal data be collected for specified, explicit purposes and not further processed in ways incompatible with those original purposes.

Correct Answer: Keeping personal data no longer than necessary for its purpose

Storage limitation requires that personal data be retained only as long as needed for the stated purpose, after which it should be deleted or anonymized.

Correct Answer: A structured review of privacy risks before high-risk processing begins

A DPIA systematically identifies and mitigates privacy risks before undertaking processing likely to result in high risk to individuals, such as large-scale profiling.

Correct Answer: It violates user expectations and undermines meaningful consent

Selling data users did not knowingly agree to share breaches their reasonable expectations and renders consent meaningless, damaging trust and often violating law.

Correct Answer: Using digital platforms to harass, threaten, or humiliate someone

Cyberbullying uses digital channels to repeatedly harass, threaten, or humiliate a person, with effects amplified by the permanence and reach of online content.

Correct Answer: Balancing free expression with protecting users from serious harm

Platforms must balance free expression against duties to protect users from harassment, incitement, and other serious harms, applying clear and consistently enforced policies.

Correct Answer: False information spread regardless of intent to deceive

Misinformation is false or inaccurate information spread without necessarily intending to deceive, while disinformation is false information deliberately spread to mislead.

Correct Answer: Synthetic media convincingly depicting someone saying or doing something they did not

Deepfakes use machine learning to create realistic but fabricated images, audio, or video of real people, raising serious risks of fraud, defamation, and erosion of trust in evidence.

Correct Answer: Audiences may be deceived about the origin and reliability of the content

Undisclosed AI-generated content can mislead audiences about its origin and authority, undermining informed judgment and trust, which is why disclosure norms are emerging.