Consider the following statements regarding Technological determinism in social credit systems:
1. Article 12 of the 2018 EU GDPR framework grants data subjects the right to obtain information regarding the existence of automated decision-making, including profiling, which serves as a regulatory counterpoint to social credit mechanisms.
2. The 2014 State Council document titled 'Planning Outline for the Construction of a Social Credit System' established the primary roadmap for integrating financial and administrative data across Chinese provinces.
3. The 2019 Digital Personal Data Protection Bill in India references the use of 'nudge units' for behavioral modification, which draws upon the 2017 Economic Survey’s discussion on the JAM trinity for credit assessment.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is incorrect.
Statement 1 is correct as Article 12-15 of the GDPR mandates transparency regarding automated decision-making to mitigate algorithmic opacity. Statement 2 is correct because the 2014 State Council document provided the foundational blueprint for China's centralized social credit architecture. Statement 3 is incorrect because while the 2017 Economic Survey discussed 'nudge' theory for social policy, the 2019 Digital Personal Data Protection Bill did not include provisions for 'nudge units' for behavioral modification, and the JAM trinity focuses on financial inclusion rather than credit assessment.
Consider the following statements regarding Consent architecture in dark patterns:
1. Under the 2022 Digital Personal Data Protection Bill, the Data Protection Board of India holds the authority to classify specific UI/UX design patterns as deceptive, provided they occur within platforms exceeding 50 million registered users.
2. The 2016 FTC workshop on 'Illusion of Choice' identified 'confirmshaming' as a violation of the Consumer Protection Act, establishing a penalty threshold of 500,000 rupees for first-time digital offenders.
3. The 2018 GDPR framework introduced the 'Right to Explanation' for automated decisions, which legally prohibits the use of interface designs that prioritize business metrics over user navigation.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the Digital Personal Data Protection Act, 2023, does not contain specific provisions empowering the Data Protection Board to classify UI/UX patterns based on a 50-million user threshold. Statement 2 is incorrect as the 2016 FTC workshop did not establish penalties under the Indian Consumer Protection Act, which is a domestic legislation unrelated to US FTC proceedings. Statement 3 is incorrect because while GDPR provides a 'Right to Explanation' for automated decisions, it does not legally prohibit interface designs that prioritize business metrics, nor does it regulate UI/UX design patterns in that specific manner.
Consider the following statements regarding Zero-knowledge proofs for identity verification:
1. In the context of blockchain-based identity, the zk-SNARK protocol reduces the size of proof data to a few hundred bytes, facilitating efficient verification on resource-constrained mobile devices.
2. The Digital Personal Data Protection Act of 2023 in India includes provisions that encourage the adoption of Privacy by Design, which aligns with the technical implementation of zero-knowledge identity verification.
3. Zero-knowledge proofs allow a prover to demonstrate the validity of a statement to a verifier without revealing the underlying data, as outlined in the 1985 Goldwasser-Micali-Rackoff paper.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) enable compact proofs, making them ideal for mobile environments. Statement 2 is correct because the DPDP Act 2023 explicitly mandates 'Privacy by Design' and 'Privacy by Default' principles, which are technically supported by zero-knowledge architectures that minimize data exposure. Statement 3 is correct as the 1985 foundational paper by Goldwasser, Micali, and Rackoff formally introduced the concept of zero-knowledge proofs, establishing the mathematical framework for proving information validity without revealing the data itself.
Consider the following statements regarding Interoperability of data protection frameworks:
1. The Convention 108+ of the Council of Europe, modernized in 2018, provides for the automatic recognition of data protection standards across all member states of the United Nations to streamline digital trade.
2. The EU-U.S. Data Privacy Framework, adopted in July 2023, addresses the legal concerns raised by the Court of Justice of the European Union in the Schrems II judgment regarding surveillance practices.
3. The 2019 Personal Data Protection Bill in India included a specific provision for the creation of a Data Protection Authority that functions as a joint regulatory body with the European Data Protection Board.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 1 is incorrect. Statement 3 is incorrect.
Statement 2 is correct because the EU-U.S. Data Privacy Framework was established in 2023 to provide a legal basis for transatlantic data flows, specifically addressing the Schrems II ruling by introducing new safeguards against U.S. signals intelligence surveillance. Statement 1 is incorrect because Convention 108+ is a Council of Europe treaty open to any country, but it does not mandate automatic recognition of standards across all UN member states. Statement 3 is incorrect because, while the 2019 Bill proposed a Data Protection Authority, it was an independent Indian regulatory body and had no provision for it to function as a joint regulatory body with the European Data Protection Board.
Consider the following statements regarding Anonymization vs. Pseudonymization techniques:
1. Pseudonymization involves the replacement of identifiers with artificial surrogates, a technique endorsed by the 2016 Privacy Shield framework to ensure data remains permanently outside the reach of intelligence agencies.
2. The GDPR, which became enforceable on May 25, 2018, distinguishes between anonymization as a process that renders data non-identifiable and pseudonymization as a reversible technical measure.
3. Recital 26 of the General Data Protection Regulation clarifies that anonymized information, where the data subject is no longer identifiable, falls outside the scope of data protection principles.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because the 2016 Privacy Shield framework was a data transfer mechanism between the EU and US, not a technical standard for rendering data permanently unreachable by intelligence agencies. Statement 2 is correct as the GDPR, effective from May 25, 2018, explicitly defines pseudonymization as a reversible process that still constitutes personal data, whereas anonymization is treated as an irreversible process. Statement 3 is correct because Recital 26 of the GDPR clarifies that the principles of data protection do not apply to anonymous information, as it no longer relates to an identified or identifiable natural person.
Consider the following statements regarding Data portability and market dominance:
1. The Competition and Markets Authority (CMA) of the United Kingdom launched a market study in 2020 focusing on the dominance of digital advertising platforms and the role of data-driven competitive advantages.
2. In the 2018 Cambridge Analytica scandal, the misuse of user data harvested from Facebook via third-party applications highlighted significant gaps in platform data portability and consent mechanisms.
3. The California Consumer Privacy Act (CCPA), effective since January 1, 2020, grants consumers the right to request the specific pieces of personal information a business has collected about them.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as the UK's CMA published its final report in July 2020, confirming that Google and Facebook held significant market power in digital advertising due to their vast data advantages. Statement 2 is correct because the 2018 scandal revealed that third-party apps exploited Facebook's API to harvest data without explicit user consent, exposing critical failures in platform governance and data portability frameworks. Statement 3 is correct as the CCPA, which became effective on January 1, 2020, explicitly grants California residents the right to access, delete, and opt-out of the sale of their personal information collected by businesses.
Consider the following statements regarding Privacy-enhancing technologies (PETs) in governance:
1. Zero-knowledge proofs, popularized by the 1985 Goldwasser-Micali-Rackoff paper, form the primary basis for the 2008 Bitcoin whitepaper's consensus mechanism.
2. The 2019 Personal Data Protection Bill proposed the creation of a Data Protection Authority of India, which was modeled after the 2016 California Consumer Privacy Act.
3. The 2022 Digital Personal Data Protection Act includes provisions for the establishment of a Data Protection Board, which replaced the 2018 Srikrishna Committee's recommendation for a sectoral ombudsman.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because while Zero-knowledge proofs are a cryptographic milestone, Bitcoin's consensus relies on Proof-of-Work, not ZK-proofs. Statement 2 is incorrect as the Data Protection Authority of India was inspired by the GDPR (General Data Protection Regulation) of the EU, not the California Consumer Privacy Act. Statement 3 is incorrect because the Srikrishna Committee report explicitly recommended a statutory Data Protection Authority, not a sectoral ombudsman, and the 2022 Act evolved from these specific committee recommendations rather than replacing a non-existent ombudsman proposal.
Consider the following statements regarding Predictive analytics in targeted political campaigning:
1. Article 22 of the General Data Protection Regulation (GDPR) provides individuals the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects.
2. The 2019 report by the High-Level Expert Group on Artificial Intelligence commissioned by the European Commission emphasizes that predictive analytics in political campaigning should maintain human agency and oversight.
3. The 2018 Cambridge Analytica scandal involved the unauthorized harvesting of personal data from approximately 87 million Facebook profiles to build psychological profiles for political micro-targeting.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as Article 22 of the GDPR explicitly protects individuals against fully automated decision-making that significantly impacts them. Statement 2 is correct because the EU's High-Level Expert Group on AI released 'Ethics Guidelines for Trustworthy AI' in 2019, which mandates that AI systems must ensure human agency and oversight to prevent manipulation. Statement 3 is correct as the 2018 Cambridge Analytica scandal confirmed that data from 87 million users was harvested without consent to create psychographic profiles for targeted political influence.
Consider the following statements regarding Data portability and market dominance:
1. The 2019 OECD Privacy Guidelines provide for the principle of data portability as a core requirement, which was subsequently incorporated into the 2020 Digital Services Act to regulate platform interoperability.
2. The 2017 Justice K.S. Puttaswamy v. Union of India judgment recognized the right to privacy as a fundamental right and included provisions for the immediate transfer of personal data between competing social media platforms.
3. The 2022 Data Governance Act of the European Union encompasses rules for the reuse of public sector data and introduces the concept of data altruism, which is linked to the automatic portability of financial records across banking institutions.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the OECD Privacy Guidelines (1980/2013) do not mandate data portability, and the EU Digital Services Act (2022) focuses on content moderation rather than data portability, which is governed by the GDPR. Statement 2 is incorrect because the Puttaswamy judgment (2017) established privacy as a fundamental right under Article 21 but did not mandate the transfer of personal data between competing platforms. Statement 3 is incorrect because the EU Data Governance Act (2022) focuses on data sharing and altruism for public/research purposes, while the portability of financial records is governed by the separate Payment Services Directive (PSD2).
Consider the following statements regarding Interoperability of data protection frameworks:
1. The 2018 California Consumer Privacy Act (CCPA) incorporates the GDPR's concept of adequacy decisions to permit data transfers between the United States and the European Union member states.
2. The 2016 Privacy Shield agreement established a centralized oversight body for global data interoperability and replaced the Safe Harbor principles for all signatory nations of the OECD.
3. The General Data Protection Regulation (GDPR) Article 45 establishes the mechanism for adequacy decisions, allowing the European Commission to recognize that a third country provides an essentially equivalent level of data protection.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 3 is correct. Statement 1 is incorrect. Statement 2 is incorrect.
Statement 3 is correct because Article 45 of the GDPR empowers the European Commission to determine if a third country ensures an 'adequate' level of protection, facilitating seamless data transfers. Statement 1 is incorrect because the CCPA is a state-level California law that does not incorporate GDPR adequacy mechanisms, which are EU-level regulatory tools. Statement 2 is incorrect because the Privacy Shield was a bilateral framework between the EU and the US-not an OECD-wide agreement-and it was invalidated by the CJEU in the Schrems II ruling, rather than serving as a permanent centralized global oversight body.
Consider the following statements regarding Anonymization vs. Pseudonymization techniques:
1. Hashing is a cryptographic function used in pseudonymization, and under the 2019 Srikrishna Committee report, it is classified as a form of anonymization that removes the need for user consent.
2. Synthetic data generation creates artificial datasets based on original distributions, a practice that the 2021 OECD guidelines define as a method of anonymization that eliminates the need for data protection impact assessments.
3. Tokenization replaces sensitive data with non-sensitive equivalents, a process widely adopted in the financial sector that satisfies the data minimization principle defined in the 2012 Justice K.S. Puttaswamy judgment.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the Srikrishna Committee Report (2018) classifies hashing as pseudonymization, not anonymization, as it remains reversible with a key. Statement 2 is incorrect because the OECD guidelines do not exempt synthetic data from Data Protection Impact Assessments (DPIAs), as synthetic datasets can still pose re-identification risks. Statement 3 is incorrect because the 2017 Justice K.S. Puttaswamy judgment established the fundamental right to privacy, but it did not define the technical parameters of data minimization; that principle was formally codified in the Digital Personal Data Protection Act, 2023.
Consider the following statements regarding Surveillance capitalism and cognitive liberty:
1. The 2023 Digital Personal Data Protection Act in India defines a 'Data Fiduciary' as any person who determines the purpose and means of processing personal data.
2. The 2016 Privacy Shield framework replaced the Safe Harbor agreement to address cognitive liberty concerns, providing a legal basis for data transfers until its invalidation in 2020.
3. The General Data Protection Regulation (GDPR), which became enforceable in the European Union on May 25, 2018, introduced the 'right to be forgotten' as a core data subject right.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 3 is correct. Statement 2 is incorrect.
Statement 1 is correct as Section 2(i) of the DPDP Act 2023 defines a 'Data Fiduciary' as any person who determines the purpose and means of processing personal data. Statement 3 is correct because the GDPR, enforceable from May 25, 2018, explicitly codified the 'right to erasure' or 'right to be forgotten' under Article 17. Statement 2 is incorrect because the Privacy Shield was designed to facilitate transatlantic commercial data transfers to ensure compliance with EU data protection standards, not specifically to address 'cognitive liberty' concerns, and it was invalidated by the CJEU in the Schrems II ruling due to surveillance concerns.
Consider the following statements regarding Behavioral surplus in surveillance capitalism:
1. The 2022 Digital Services Act of the European Union addresses systemic risks posed by very large online platforms, and it incorporates the specific behavioral surplus definitions established in the 2002 ePrivacy Directive.
2. The 2017 Srikrishna Committee report on data protection recommended the establishment of a Data Protection Authority, and it proposed the implementation of a national biometric database for all digital transactions.
3. The 2018 General Data Protection Regulation (GDPR) Article 4 defines profiling as any form of automated processing of personal data to evaluate certain personal aspects relating to a natural person.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 3 is correct. Statement 1 is incorrect. Statement 2 is incorrect.
Statement 3 is correct because Article 4(4) of the GDPR explicitly defines profiling as automated processing to evaluate personal aspects, a cornerstone of surveillance capitalism. Statement 1 is incorrect because the Digital Services Act (2022) focuses on content moderation and systemic risk, not the 2002 ePrivacy Directive, which primarily regulates electronic communications. Statement 2 is incorrect because while the Srikrishna Committee recommended a Data Protection Authority, it did not propose a national biometric database for all digital transactions, as that would contradict its emphasis on data minimization and privacy safeguards.
Consider the following statements regarding Behavioral surplus in surveillance capitalism:
1. In the 2014 Facebook emotional contagion study, researchers manipulated the news feeds of 689,003 users to observe the impact of emotional content on subsequent user posts.
2. The 2023 Digital Personal Data Protection Act of India introduces the concept of a 'Data Fiduciary' who determines the purpose and means of processing personal data.
3. Google's 2004 transition to the AdWords platform marked a shift toward utilizing search query data to refine the accuracy of targeted advertising algorithms.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as the 2014 Facebook study manipulated news feeds of 689,003 users to test emotional contagion. Statement 2 is correct because the DPDP Act, 2023, explicitly defines a 'Data Fiduciary' as any person who determines the purpose and means of processing personal data. Statement 3 is correct because Google's 2004 transition to the AdWords platform utilized search query data to create 'behavioral surplus,' transforming raw search data into predictive advertising models.
Consider the following statements regarding Biometric surveillance in smart city infrastructure:
1. The Digital Personal Data Protection Act, 2023, provides for the creation of a national biometric database, and it allows for the sharing of this data with private smart city vendors without prior user notification.
2. The facial recognition technology deployed under the Safe City Project in Hyderabad utilizes the Telangana State Police Integrated Automated Fingerprint Identification System for criminal investigation purposes.
3. The 2018 EU General Data Protection Regulation (GDPR) includes provisions that allow data subjects to request the deletion of their personal information, commonly referred to as the right to be forgotten.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because the Digital Personal Data Protection Act, 2023, focuses on regulating data processing and does not mandate a national biometric database or authorize the sharing of biometric data with private vendors without consent. Statement 2 is correct as the Safe City Project in Hyderabad integrates various surveillance feeds, including the Telangana State Police's Automated Fingerprint Identification System (TSPAFIS), to enhance criminal investigation capabilities. Statement 3 is correct because Article 17 of the 2018 EU GDPR explicitly codifies the 'right to erasure,' empowering data subjects to request the deletion of their personal data under specific conditions.
Consider the following statements regarding Differential privacy in statistical datasets:
1. Apple implemented differential privacy in 2016 to collect user behavior data from iOS devices while preventing the association of specific activities with individual users.
2. The privacy budget, or epsilon, determines the trade-off between the accuracy of the statistical output and the level of protection afforded to individual records.
3. The General Data Protection Regulation (GDPR) Recital 26 acknowledges that anonymization techniques, including noise addition, assist in mitigating risks of re-identification.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as Apple introduced differential privacy in 2016 to gather insights like emoji usage and QuickType suggestions without compromising individual user identity. Statement 2 is correct because the 'epsilon' parameter acts as a mathematical knob; a lower epsilon increases noise to enhance privacy at the cost of accuracy, while a higher epsilon provides more precise data with less protection. Statement 3 is correct because GDPR Recital 26 explicitly identifies techniques like noise addition as methods to render personal data anonymous, thereby exempting the resulting dataset from stringent GDPR processing requirements.
Consider the following statements regarding Algorithmic bias in predictive policing:
1. The 2019 study published in Science by Obermeyer et al. demonstrated that a widely used healthcare algorithm exhibited racial bias by prioritizing white patients for complex care management programs.
2. The Justice in Forensic Algorithms Act of 2019 draws its legal foundation from the 1974 Privacy Act, which established the first federal standards for automated record-keeping systems in the United States.
3. The Justice in Forensic Algorithms Act of 2019 was introduced in the U.S. Congress to provide for the disclosure of source code in criminal proceedings involving proprietary predictive software.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 3 is correct. Statement 2 is incorrect.
Statement 1 is correct as the 2019 Obermeyer et al. study in Science revealed that an algorithm used on millions of patients systematically discriminated against Black patients by using health costs as a proxy for health needs. Statement 3 is correct because the Justice in Forensic Algorithms Act of 2019 was introduced to mandate that defendants in criminal cases have the right to examine the source code of proprietary software used as evidence. Statement 2 is incorrect because the Justice in Forensic Algorithms Act is not derived from the 1974 Privacy Act; the 1974 Act regulates how federal agencies collect and maintain records on individuals, whereas the 2019 bill focuses on transparency in criminal justice algorithms.
Consider the following statements regarding Cross-border data flow and digital sovereignty:
1. The 2016 Privacy Shield Framework, which governed transatlantic data flows between the EU and the US, was invalidated by the Court of Justice of the European Union in the Schrems II ruling of July 2020.
2. The 2001 Convention 108+ represents the modernized version of the Council of Europe's data protection treaty, and it serves as the primary legal instrument for data flow regulation within the ASEAN digital trade bloc.
3. The 2019 draft of the Personal Data Protection Bill in India introduced the concept of data localization for sensitive personal data, which mirrors the 2017 cloud computing guidelines issued by the Reserve Bank of India.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is correct because the CJEU invalidated the Privacy Shield in the Schrems II ruling due to concerns over US surveillance practices failing to provide adequate protection for EU citizens' data. Statement 2 is incorrect because Convention 108+ is a Council of Europe treaty, whereas ASEAN operates under the ASEAN Framework on Personal Data Protection, not this European instrument. Statement 3 is incorrect because while the 2019 Bill proposed data localization, the RBI's 2018 (not 2017) mandate specifically required payment system data to be stored exclusively in India, representing a sectoral regulatory approach rather than a direct mirror of the broader legislative draft.
Consider the following statements regarding Right to be forgotten vs. Public record:
1. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021 provide for the removal of content by intermediaries, and these rules are derived from the recommendations of the 2012 Shah Committee on Privacy.
2. The Justice K.S. Puttaswamy v. Union of India (2017) judgment recognized the right to privacy as a fundamental right protected under Article 21 of the Indian Constitution.
3. The Digital Personal Data Protection Act, 2023, includes provisions that allow data principals to nominate another individual to exercise their rights in the event of death or incapacity.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because the 2021 IT Rules are framed under the IT Act, 2000, and are not derived from the 2012 Shah Committee, which focused on a framework for a comprehensive privacy law. Statement 2 is correct as the landmark 2017 Puttaswamy judgment established the right to privacy as an intrinsic part of the right to life and personal liberty under Article 21. Statement 3 is correct because Section 14 of the Digital Personal Data Protection Act, 2023, explicitly grants data principals the right to nominate an individual to exercise their rights in the event of death or incapacity.
Consider the following statements regarding Data fiduciary obligations in public health surveillance:
1. The WHO Global Strategy on Digital Health 2020-2025 emphasizes the necessity of data sovereignty and ethical governance in the deployment of public health surveillance systems.
2. The 2005 International Health Regulations include provisions for the automatic sharing of genetic sequence data, which is governed by the Nagoya Protocol on Access and Benefit Sharing.
3. Section 8 of the Information Technology (Reasonable Security Practices and Procedures) Rules 2011 outlines the standards for body corporates to maintain records of sensitive personal data.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 3 is correct. Statement 2 is incorrect.
Statement 1 is correct as the WHO Global Strategy on Digital Health 2020-2025 explicitly prioritizes ethical governance and data sovereignty to protect individual rights in digital health ecosystems. Statement 3 is correct because Section 8 of the IT Rules, 2011, mandates that body corporates must maintain reasonable security practices and procedures for handling sensitive personal data. Statement 2 is incorrect because the 2005 International Health Regulations do not mandate automatic sharing of genetic sequence data; furthermore, the Nagoya Protocol focuses on genetic resources in the context of biodiversity, not public health surveillance data sharing.
Consider the following statements regarding Metadata harvesting and metadata analytics:
1. Under the 2023 Digital Personal Data Protection Act of India, data fiduciaries are tasked with maintaining the accuracy of personal data processed for the purpose of providing services to data principals.
2. The 2016 Privacy Shield Framework, which replaced the Safe Harbor principles for transatlantic data transfers, allows for the collection of bulk metadata by intelligence agencies and provides for a dedicated ombudsperson to handle complaints from EU citizens.
3. The 2000 Information Technology Act was amended in 2008 to include Section 69B, which provides the government with the authority to monitor traffic data for cyber security purposes and includes provisions for the permanent storage of encrypted metadata.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is correct as Section 8(8) of the DPDP Act, 2023 mandates that data fiduciaries must ensure the accuracy of personal data processed for service delivery. Statement 2 is incorrect because the Privacy Shield was invalidated by the CJEU in the Schrems II ruling (2020) due to concerns over bulk surveillance, and it did not explicitly authorize bulk metadata collection by intelligence agencies. Statement 3 is incorrect because while Section 69B of the IT Act (inserted in 2008) empowers the government to monitor traffic data for cybersecurity, it does not contain provisions for the permanent storage of encrypted metadata.
Consider the following statements regarding Biometric surveillance in smart city infrastructure:
1. The 2017 Puttaswamy judgment established the Data Protection Board as a statutory body, and it functions under the administrative control of the Ministry of Electronics and Information Technology.
2. The 2017 Supreme Court judgment in Justice K.S. Puttaswamy v. Union of India recognized the right to privacy as a fundamental right protected under Article 21 of the Constitution.
3. The Information Technology Act, 2000, was amended in 2008 to include Section 66A, which provides for the regulation of biometric data collection in smart city public infrastructure projects.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 1 is incorrect. Statement 3 is incorrect.
Statement 2 is correct because the landmark 2017 Puttaswamy judgment unanimously declared the right to privacy as an intrinsic part of the right to life and personal liberty under Article 21. Statement 1 is incorrect as the Data Protection Board was established under the Digital Personal Data Protection Act, 2023, not the 2017 judgment. Statement 3 is incorrect because Section 66A of the IT Act, 2000, dealt with offensive messages and was struck down as unconstitutional by the Supreme Court in 2015; it has no relation to the regulation of biometric data collection.
Consider the following statements regarding Biometric surveillance in smart city infrastructure:
1. The Personal Data Protection Bill, 2019, proposed the establishment of a Data Protection Authority of India to oversee the processing of personal data by state and private entities.
2. Section 43A of the Information Technology Act, 2000, provides for compensation to individuals if a corporate body fails to implement reasonable security practices for sensitive personal data.
3. The 2018 GDPR framework includes provisions for the mandatory storage of biometric data within the member state of origin, and this requirement applies to all multinational cloud service providers.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is incorrect.
Statement 1 is correct as the 2019 Bill aimed to establish a Data Protection Authority to regulate data processing, while Statement 2 is correct because Section 43A of the IT Act, 2000, mandates compensation for negligence in handling sensitive personal data. Statement 3 is incorrect because the GDPR does not mandate data localization (storage within the member state of origin); rather, it focuses on the protection of personal data and allows for cross-border data transfers under specific adequacy or safeguard conditions.
Consider the following statements regarding Surveillance capitalism and cognitive liberty:
1. The 2017 Justice K.S. Puttaswamy v. Union of India judgment recognized the right to privacy as a fundamental right protected under Article 21 of the Indian Constitution.
2. The 2000 Safe Harbor Agreement between the US and EU facilitated transatlantic data flows, but it was invalidated by the 2015 Schrems I ruling regarding mass surveillance concerns.
3. The OECD Privacy Guidelines of 1980 introduced the 'Purpose Specification Principle' to limit data collection, which was later incorporated into the 1995 EU Data Protection Directive.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is correct as the Supreme Court in the 2017 Puttaswamy judgment unanimously declared privacy a fundamental right under Article 21. Statement 2 is also correct, as the 2000 Safe Harbor framework was indeed invalidated by the CJEU in the 2015 Schrems I ruling due to US mass surveillance practices. Statement 3 is also correct, as the 1980 OECD Guidelines established the Purpose Specification Principle, which served as a foundational pillar for the 1995 EU Data Protection Directive. Therefore, all three statements are correct.
Consider the following statements regarding Predictive analytics in targeted political campaigning:
1. In the 2017 German federal election, political parties utilized 'Wahl-O-Mat' applications, which processed user data to provide personalized policy recommendations based on algorithmic matching of voter preferences.
2. The 2023 Digital Services Act of the European Union introduces specific transparency requirements for online platforms regarding the parameters used by recommender systems to influence voter behavior.
3. Section 43A of the Information Technology Act, 2000, in India, provides for compensation to be paid by a body corporate if it fails to implement reasonable security practices to protect sensitive personal data.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as the 'Wahl-O-Mat' tool, used since 2002 and prominently in 2017, matches voter preferences with party manifestos using algorithmic processing. Statement 2 is correct because the 2023 Digital Services Act (DSA) mandates that Very Large Online Platforms (VLOPs) provide transparency regarding the parameters of recommender systems to mitigate risks to electoral processes. Statement 3 is correct as Section 43A of the IT Act, 2000, mandates that bodies corporate handling sensitive personal data must implement reasonable security practices, failing which they are liable to pay compensation to affected persons.
Consider the following statements regarding Interoperability of data protection frameworks:
1. The Asia-Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CBPR) system serves as a voluntary accountability-based framework designed to facilitate data flows between participating economies in the region.
2. The Budapest Convention on Cybercrime, opened for signature in 2001, contains provisions for international cooperation in obtaining electronic evidence, though it does not focus on commercial data privacy frameworks.
3. The OECD Privacy Guidelines, originally adopted in 1980 and updated in 2013, introduced the eight basic principles of data protection that influenced the development of many national privacy legislations globally.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as the APEC CBPR is a voluntary, accountability-based system that facilitates secure data transfers across borders. Statement 2 is correct because the Budapest Convention focuses on harmonizing national laws against cybercrime and facilitating international evidence gathering, rather than regulating commercial data privacy. Statement 3 is correct as the OECD's 1980 Guidelines, updated in 2013, established the foundational 'Fair Information Practice Principles' (FIPPs) that serve as the global benchmark for modern data protection laws.
Consider the following statements regarding Encryption backdoors and national security:
1. The 2013 Snowden disclosures revealed the PRISM program operated by the NSA, and the subsequent USA Freedom Act of 2015 replaced the bulk collection authority granted under the 2001 Patriot Act.
2. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, introduced a requirement for significant social media intermediaries to identify the first originator of information.
3. The Budapest Convention on Cybercrime, opened for signature in 2001, serves as the first international treaty seeking to address internet and computer crime by harmonizing national laws.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because the USA Freedom Act of 2015 did not replace the bulk collection authority but rather modified it to require the NSA to request specific records from telecommunications companies rather than collecting bulk metadata directly. Statement 2 is correct as the IT Rules 2021 mandate 'significant social media intermediaries' to enable the identification of the first originator of information to curb misinformation. Statement 3 is correct because the 2001 Budapest Convention remains the first and only binding international instrument designed to harmonize national laws and investigative techniques for cybercrime.
Consider the following statements regarding Digital footprinting in credit scoring models:
1. The Fair Credit Reporting Act of 1970 established the framework for alternative data usage, and the 2010 Dodd-Frank Act expanded this to include social media sentiment analysis for consumer lending.
2. The 2018 California Consumer Privacy Act grants residents the right to opt-out of the sale of personal information, and the 2020 amendment extended these protections to include credit score portability across banking institutions.
3. The Basel III Accord introduced the standardized approach for credit risk, and the 2017 amendment incorporated provisions for the inclusion of non-financial digital footprints in Tier-1 capital calculations.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
All three statements are incorrect because they misattribute regulatory frameworks: the Fair Credit Reporting Act (1970) focuses on traditional credit data, not social media sentiment; the California Consumer Privacy Act (2018) does not mandate credit score portability; and the Basel III Accord focuses on capital adequacy and risk-weighted assets, having no provisions for incorporating non-financial digital footprints into Tier-1 capital calculations.
Consider the following statements regarding Consent architecture in dark patterns:
1. The 2021 OECD Guidelines on Digital Privacy suggest that consent architecture should be neutral, and they define 'dark patterns' as technical configurations that are legally binding under the 2023 G20 Digital Economy Task Force report.
2. The 2014 EU Cookie Law revision specifies that consent must be granular, and it provides a technical exemption for platforms that utilize 'nudging' to improve user engagement during the initial sign-up phase.
3. The 2019 California Consumer Privacy Act (CCPA) includes provisions for 'opt-out' mechanisms, and it formally categorizes the use of pre-ticked checkboxes as a breach of the 'Do Not Sell My Personal Information' standard.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the OECD guidelines are non-binding recommendations, and the G20 report does not establish legal definitions for dark patterns. Statement 2 is false as the EU's GDPR (not a 2014 revision) mandates that consent must be freely given and unambiguous, explicitly prohibiting 'nudging' or deceptive UI patterns that manipulate user choice. Statement 3 is incorrect because while the CCPA mandates opt-out rights, it does not explicitly categorize pre-ticked checkboxes as a breach of the 'Do Not Sell' standard, as such practices are generally governed by broader 'dark pattern' prohibitions under the CCPA/CPRA regulations.
Consider the following statements regarding Privacy-enhancing technologies (PETs) in governance:
1. Federated learning, introduced by Google researchers in 2017, allows for decentralized model training and was first applied to the Android Gboard predictive text feature.
2. The 2000 Information Technology Act was amended in 2008 to include Section 43A, which mirrors the 1995 EU Data Protection Directive's requirements for corporate liability.
3. The 2017 Justice K.S. Puttaswamy v. Union of India judgment established the right to privacy as a fundamental right under Article 21 of the Indian Constitution.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 3 is correct. Statement 1 is incorrect. Statement 2 is incorrect.
Statement 3 is correct as the Supreme Court in the 2017 Puttaswamy judgment unanimously declared privacy a fundamental right under Article 21. Statement 1 is incorrect because while Google pioneered federated learning, it was introduced in 2016, not 2017. Statement 2 is incorrect because Section 43A of the IT Act, 2000 (added in 2008) focuses on compensation for failure to protect sensitive personal data, but it does not mirror the 1995 EU Data Protection Directive, which established a comprehensive framework for data processing that India lacked until the Digital Personal Data Protection Act, 2023.
Consider the following statements regarding Anonymization vs. Pseudonymization techniques:
1. The ISO/IEC 20889 standard provides a framework for de-identification, categorizing k-anonymity as a method that guarantees the impossibility of re-identification through linkage attacks.
2. Differential privacy adds mathematical noise to datasets, a technique first proposed by Cynthia Dwork in 2006 that serves as the primary legal standard for compliance under the Digital Personal Data Protection Act of 2023.
3. The HIPAA Safe Harbor method permits the removal of 18 specific identifiers, a process that converts protected health information into anonymous data for secondary research without additional statistical verification.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because k-anonymity does not guarantee immunity from re-identification, as it remains vulnerable to homogeneity and background knowledge attacks. Statement 2 is false because while differential privacy is a robust statistical technique, the Digital Personal Data Protection Act (DPDPA) 2023 does not mandate it as a primary legal standard for compliance. Statement 3 is incorrect because the HIPAA Safe Harbor method results in 'de-identified' data rather than 'anonymous' data, and such data is still subject to regulatory oversight and specific usage conditions rather than being legally classified as fully anonymous.
Consider the following statements regarding Consent architecture in dark patterns:
1. The 2020 Data Governance Act of the European Union addresses consent fatigue by introducing a centralized dashboard, which operates under the oversight of the European Data Protection Supervisor established in 2004.
2. The 2022 Indian Guidelines for Prevention of Misleading Advertisements identify 'false urgency' as a deceptive practice, and they grant the Central Consumer Protection Authority the power to issue injunctions against platforms with over 10 million monthly visitors.
3. The 2017 Singapore Personal Data Protection Commission guidelines on dark patterns allow for 'subscription traps' if the platform provides a clear exit link within three clicks, as per the 2020 advisory on electronic commerce.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the EU Data Governance Act (2022) focuses on data sharing and interoperability, not consent fatigue, and the EDPS was established in 2004 but does not oversee a centralized consent dashboard. Statement 2 is incorrect because while the CCPA regulates misleading advertisements, the 2022 guidelines do not restrict injunction powers based on a 10 million monthly visitor threshold. Statement 3 is incorrect as Singapore's PDPC guidelines strictly prohibit 'subscription traps' and deceptive design patterns, and no such advisory from 2020 permits them under a 'three-click' rule.
Consider the following statements regarding Behavioral surplus in surveillance capitalism:
1. The 2019 California Consumer Privacy Act provides residents with the right to opt-out of the sale of personal information, and it serves as the primary enforcement mechanism for the federal Data Privacy Act of 2020.
2. Shoshana Zuboff defines behavioral surplus as the raw data captured beyond what is necessary for service improvement, which is subsequently repurposed for predictive modeling.
3. The 2016 Cambridge Analytica incident involved the unauthorized harvesting of data from 87 million users, which led to the adoption of the Privacy Shield Framework by the European Commission.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 1 is incorrect. Statement 3 is incorrect.
Statement 2 is correct as Shoshana Zuboff defines behavioral surplus as the excess raw data extracted from user activity beyond service improvement needs, used to create predictive products. Statement 1 is incorrect because the US lacks a comprehensive federal Data Privacy Act of 2020, and the CCPA is a state-level law, not a federal enforcement mechanism. Statement 3 is incorrect because the Cambridge Analytica scandal primarily accelerated the implementation of the General Data Protection Regulation (GDPR) in 2018, whereas the Privacy Shield Framework was established in 2016 to replace the invalidated Safe Harbor agreement.
Consider the following statements regarding Zero-knowledge proofs for identity verification:
1. The 2022 G20 Bali Leaders' Declaration on digital transformation includes a framework for interoperable digital identities, which utilizes the zero-knowledge proof standard developed by the World Wide Web Consortium (W3C) in 2015.
2. Zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) rely on a common reference string generated during a trusted setup phase to ensure the integrity of the cryptographic proof.
3. The National Institute of Standards and Technology (NIST) Special Publication 800-63-3 identifies cryptographic protocols that minimize the collection of personally identifiable information during remote identity proofing.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because while the G20 Bali Declaration emphasizes digital public infrastructure, it does not mandate a specific W3C zero-knowledge proof standard from 2015. Statement 2 is correct as zk-SNARKs typically require a 'trusted setup' to generate a common reference string, which is essential for verifying proofs without revealing underlying data. Statement 3 is correct because NIST SP 800-63-3 provides guidelines for digital identity services, specifically advocating for privacy-enhancing technologies that limit the collection and retention of personally identifiable information (PII) during identity verification.
Consider the following statements regarding Right to be forgotten vs. Public record:
1. The 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, known as Convention 108, represents the first binding international instrument concerning data protection.
2. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, adopted in 1980, introduced the principle of individual participation, granting users the right to challenge data held about them.
3. In the 2019 case of Jorawer Singh Mundy v. Union of India, the Delhi High Court acknowledged the right to be forgotten as a facet of the right to privacy in the context of an acquitted criminal case.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Convention 108 (1981) remains the first legally binding international treaty on data protection, while the 1980 OECD Guidelines established the foundational 'Individual Participation Principle' allowing individuals to challenge data accuracy. The Delhi High Court's 2021 ruling in Jorawer Singh Mundy v. Union of India explicitly recognized the 'right to be forgotten' as a component of the right to privacy under Article 21, specifically for individuals acquitted of criminal charges. All three statements are factually accurate, as they correctly identify the historical milestones of data protection and the landmark Indian judicial precedent regarding the erasure of online records.
Consider the following statements regarding Differential privacy in statistical datasets:
1. Local differential privacy allows data to be perturbed at the user's device level before transmission to a central server for aggregate analysis.
2. The 2018 Data Protection Act in India incorporates the k-anonymity framework as the primary technical standard for all government-held datasets containing sensitive personal information.
3. Differential privacy is defined by the 2012 OECD Privacy Guidelines as the standard protocol for cross-border data transfers between member nations to ensure statistical integrity.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is correct because local differential privacy adds noise to individual data points at the source, ensuring the central server never sees raw data. Statement 2 is incorrect because the 2018 Data Protection Bill (and subsequent 2023 Act) does not mandate k-anonymity as a primary standard, as k-anonymity is vulnerable to linkage attacks and is considered outdated compared to differential privacy. Statement 3 is incorrect because the 2012 OECD Privacy Guidelines predate the widespread adoption of differential privacy and do not specify it as a protocol for cross-border data transfers.
Consider the following statements regarding Technological determinism in social credit systems:
1. The 2016 Cybersecurity Law of China introduced the concept of 'trusted internet identities' and serves as the primary legal instrument governing the cross-border transfer of social credit scores for multinational corporations.
2. The 2012 Personal Information Protection Act in Japan provides for the establishment of a centralized digital registry that links individual tax records with private sector consumer behavior analytics.
3. The 2003 E-Government Strategy in South Korea utilized the Resident Registration Number system to link public service access with private credit ratings, creating a model for the 2010 national social scoring pilot.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
All three statements are incorrect because they misattribute legal frameworks and historical developments: the 2016 Cybersecurity Law of China focuses on data localization and security rather than cross-border social credit score transfers, Japan's APPI (Act on the Protection of Personal Information) strictly prohibits the creation of such centralized registries linking tax and private data, and South Korea's Resident Registration Number system is a legacy identification tool that was never designed to integrate with private credit ratings for a national social scoring pilot.
Consider the following statements regarding Data localization mandates under DPDP Act 2023:
1. The definition of 'Data Fiduciary' in the Act includes government agencies, and these entities possess the authority to bypass consent requirements for any public interest project initiated before 2020.
2. The Digital Personal Data Protection Act 2023 received the assent of the President of India on 11 August 2023.
3. The DPDP Act 2023 provides for a tiered penalty structure reaching up to 500 crore rupees, mirroring the financial liability caps introduced in the Information Technology Amendment Act 2008.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 1 is incorrect. Statement 3 is incorrect.
Statement 2 is correct as the DPDP Act 2023 received Presidential assent on 11 August 2023. Statement 1 is incorrect because while the Act defines 'Data Fiduciary', it does not grant a blanket exemption for public interest projects initiated before 2020, but rather provides specific grounds for 'certain legitimate uses' of data without consent. Statement 3 is incorrect because the Act mandates penalties up to 250 crore rupees, not 500 crore, and these are distinct from the liability caps under the IT Act 2008.
Consider the following statements regarding Data localization mandates under DPDP Act 2023:
1. The Data Protection Board of India functions as a statutory body under the Ministry of Electronics and Information Technology, established through the 2019 draft bill framework.
2. Cross-border data transfer protocols under the 2023 Act follow the 'adequacy' model found in the European Union's GDPR, which allows for automatic data flow to all OECD member nations.
3. The 2023 legislation incorporates the recommendations of the Justice B.N. Srikrishna Committee, which suggested a blanket ban on the storage of sensitive financial data outside Indian territory.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the Data Protection Board of India is established under the DPDP Act 2023, not the 2019 draft bill, and it functions as an independent body rather than a sub-department of MeitY. Statement 2 is incorrect as the Act adopts a 'negative list' approach for cross-border transfers, where data can be transferred to all countries unless specifically restricted by the government, rather than the GDPR's 'adequacy' model. Statement 3 is incorrect because the 2023 Act does not mandate a blanket ban on sensitive financial data storage abroad, diverging from the Srikrishna Committee's original recommendations which were significantly diluted in the final legislation.
Consider the following statements regarding Metadata harvesting and metadata analytics:
1. The 2013 disclosures by Edward Snowden highlighted the NSA's PRISM program, which utilized metadata analytics to map social networks and communication patterns of foreign nationals.
2. Metadata harvesting involves the collection of non-content data such as timestamps, geolocation tags, and device identifiers rather than the actual text or audio of a communication.
3. In the 2014 case of Riley v. California, the U.S. Supreme Court ruled that police generally need a warrant to search the digital data on a cell phone seized during an arrest.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as the 2013 Snowden leaks exposed PRISM, a clandestine surveillance program where the NSA collected vast amounts of metadata to map communication networks. Statement 2 is correct because metadata refers to 'data about data'-such as timestamps, IP addresses, and geolocation-which provides context without accessing the actual content of messages. Statement 3 is correct because the Supreme Court in Riley v. California (2014) unanimously held that the digital privacy of a cell phone is protected by the Fourth Amendment, requiring a warrant for searches incident to arrest.
Consider the following statements regarding Algorithmic bias in predictive policing:
1. The COMPAS algorithm, utilized by courts in the United States since 1998, calculates recidivism risk scores based on 137 distinct variables related to criminal history and social environment.
2. In the 2016 ProPublica investigation, researchers found that Black defendants were twice as likely as white defendants to be misclassified as high-risk by predictive policing software.
3. The European Union's General Data Protection Regulation, which entered into force in May 2018, contains Article 22 regarding the right of individuals not to be subject to decisions based on automated processing.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as COMPAS, introduced in 1998, utilizes 137 items to assess recidivism risk; Statement 2 is accurate because the 2016 ProPublica investigation famously revealed that Black defendants were nearly twice as likely as white defendants to be incorrectly labeled as high-risk; Statement 3 is correct because GDPR Article 22 explicitly grants individuals the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them.
Consider the following statements regarding Algorithmic bias in predictive policing:
1. The 2019 Obermeyer study identified that the algorithm relied on healthcare spending as a proxy for health needs, a methodology first standardized by the 2010 Affordable Care Act implementation guidelines.
2. The 2016 ProPublica study focused on the PredPol system, which was developed by researchers at UCLA in 2011 to map historical crime data for patrol optimization.
3. The 2018 GDPR framework includes provisions for the 'right to explanation' under Recital 71, which originated from the 1995 Data Protection Directive's specific clauses on algorithmic transparency.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the Obermeyer study focused on racial bias in healthcare algorithms, not the Affordable Care Act guidelines. Statement 2 is incorrect because the 2016 ProPublica study analyzed the COMPAS recidivism algorithm, not the PredPol system. Statement 3 is incorrect because the 'right to explanation' is a contested interpretation of GDPR Recital 71, which was not present in the 1995 Data Protection Directive.
Consider the following statements regarding Differential privacy in statistical datasets:
1. Cynthia Dwork, a lead researcher at Microsoft, formally introduced the concept of differential privacy in a 2006 academic paper on algorithmic privacy.
2. The United States Census Bureau utilized differential privacy techniques for the first time in the 2020 Decennial Census to protect respondent confidentiality.
3. Differential privacy introduces a mathematical noise parameter, often denoted as epsilon, to mask individual contributions within a statistical dataset.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
All three statements are correct: Cynthia Dwork and her colleagues introduced the formal framework for differential privacy in their 2006 paper 'Calibrating Noise to Sensitivity in Private Data Analysis'. The U.S. Census Bureau officially adopted this approach for the 2020 Decennial Census to address privacy concerns while maintaining data utility. Furthermore, differential privacy functions by injecting controlled statistical noise, quantified by the 'privacy budget' or epsilon parameter, which mathematically ensures that the inclusion or exclusion of a single individual's data does not significantly alter the output of a query.
Consider the following statements regarding Surveillance capitalism and cognitive liberty:
1. Article 12 of the Universal Declaration of Human Rights, adopted in 1948, establishes the right to privacy against arbitrary interference with one's correspondence and home.
2. Shoshana Zuboff coined the term 'surveillance capitalism' in her 2019 work to describe the commodification of personal data for behavioral prediction and modification.
3. The 2018 Cambridge Analytica scandal involved the unauthorized harvesting of data from 87 million Facebook users, leading to the creation of the 2019 California Consumer Privacy Act.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is incorrect.
Statement 1 is correct as Article 12 of the 1948 UDHR explicitly protects individuals against arbitrary interference with privacy, family, home, or correspondence. Statement 2 is correct because Shoshana Zuboff's 2019 book, 'The Age of Surveillance Capitalism,' defined the economic system where human experience is treated as free raw material for hidden commercial practices of extraction, prediction, and sales. Statement 3 is incorrect because, while the Cambridge Analytica scandal did involve the unauthorized harvesting of data from millions of users, the California Consumer Privacy Act (CCPA) was signed into law in June 2018, months before the scandal's full global impact was finalized and prior to the 2019 timeline suggested.
Consider the following statements regarding Cross-border data flow and digital sovereignty:
1. The 2000 Safe Harbor Principles facilitated data transfers between the US and EU, and the framework remained in effect until the 2016 adoption of the Budapest Convention on Cybercrime.
2. The 2018 EU General Data Protection Regulation (GDPR) Article 45 allows for the transfer of personal data to a third country if the European Commission has issued an adequacy decision regarding that nation's data protection standards.
3. The 2023 Digital Personal Data Protection Act of India provides for the establishment of a Data Protection Board of India to oversee compliance and adjudicate grievances related to personal data processing.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because the Safe Harbor framework was invalidated by the CJEU in the 2015 'Schrems I' ruling, not replaced by the Budapest Convention, which focuses on cybercrime rather than data privacy. Statement 2 is correct as Article 45 of the GDPR empowers the European Commission to determine if a third country ensures an 'adequate' level of protection, enabling seamless data transfers. Statement 3 is correct because the Digital Personal Data Protection Act, 2023, mandates the creation of the Data Protection Board of India as an independent regulatory body to enforce compliance and address data breaches.
Consider the following statements regarding Data portability and market dominance:
1. Article 20 of the General Data Protection Regulation (GDPR) establishes the right of data subjects to receive their personal data in a structured, commonly used, and machine-readable format.
2. The Digital Personal Data Protection Act (DPDPA) of 2023 in India introduces the concept of a Data Fiduciary, which is responsible for determining the purpose and means of processing personal data.
3. The Data Portability framework under the European Data Act, adopted in 2023, aims to facilitate the switching between cloud service providers to reduce vendor lock-in effects.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as Article 20 of the GDPR mandates that data subjects can receive their personal data in a structured, machine-readable format to facilitate transfer between controllers. Statement 2 is correct because the DPDPA 2023 defines a 'Data Fiduciary' as any person or entity who determines the purpose and means of processing personal data, placing legal obligations on them. Statement 3 is correct as the EU Data Act (2023) specifically introduces measures to remove technical and commercial barriers, such as switching charges, to enable users to transition between cloud service providers and mitigate vendor lock-in.
Consider the following statements regarding Encryption backdoors and national security:
1. The 2018 Supreme Court judgment in the Justice K.S. Puttaswamy (Retd.) v. Union of India case recognized informational privacy as a fundamental right under Article 21 of the Constitution.
2. The 2019 Personal Data Protection Bill encompassed the concept of data localization for sensitive personal data, and it was drafted by the Srikrishna Committee established by the Ministry of Electronics in 2017.
3. The 2000 Information Technology Act includes provisions for state-level surveillance oversight, and it was amended in 2008 to incorporate the current Section 69A blocking powers.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is correct as the 2017 Puttaswamy judgment established informational privacy as a fundamental right under Article 21. Statement 2 is incorrect because while the Srikrishna Committee drafted the 2018 draft bill, the 2019 Personal Data Protection Bill was introduced by the government with significant deviations from the committee's recommendations. Statement 3 is incorrect because Section 69A was part of the original 2000 IT Act, and the 2008 amendment primarily expanded the scope of cybercrimes and electronic evidence rather than introducing the blocking powers.
Consider the following statements regarding Encryption backdoors and national security:
1. The 2016 FBI-Apple encryption dispute centered on a federal court order requesting the creation of a specialized software version to bypass the security features of an iPhone 5c.
2. The 2017 Justice Srikrishna Committee report refers to the necessity of encryption standards for public sector entities, and it suggests that state agencies maintain master keys for national security investigations.
3. The 2023 Digital Personal Data Protection Act establishes the Data Protection Board of India as the primary regulatory body to oversee compliance and handle grievances related to personal data processing.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 3 is correct. Statement 2 is incorrect.
Statement 1 is correct as the 2016 FBI-Apple dispute involved a court order under the All Writs Act to compel Apple to create a 'GovtOS' to bypass the passcode of an iPhone 5c used by a San Bernardino shooter. Statement 3 is correct because the Digital Personal Data Protection Act, 2023, formally establishes the Data Protection Board of India to enforce compliance and adjudicate grievances. Statement 2 is incorrect because the Justice Srikrishna Committee report (2018) actually emphasized the importance of encryption for privacy and did not recommend that the state maintain master keys, which is a position often opposed by privacy advocates.
Consider the following statements regarding Data fiduciary obligations in public health surveillance:
1. The Digital Personal Data Protection Act of 2023 defines a data fiduciary as any person who determines the purpose and means of processing personal data.
2. The 2017 Puttaswamy judgment by the Supreme Court of India established that the right to privacy is a fundamental right protected under Article 21 of the Constitution.
3. Article 12 of the Universal Declaration of Human Rights provides the foundational framework for protecting individuals against arbitrary interference with their privacy in health data collection.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct as the Digital Personal Data Protection Act, 2023 defines a 'Data Fiduciary' as any person who alone or in conjunction with others determines the purpose and means of processing personal data. Statement 2 is correct because the landmark 2017 K.S. Puttaswamy v. Union of India judgment unanimously declared the right to privacy as a fundamental right under Article 21. Statement 3 is correct as Article 12 of the Universal Declaration of Human Rights explicitly protects individuals against arbitrary interference with their privacy, family, home, or correspondence, serving as the international legal bedrock for health data privacy.
Consider the following statements regarding Cross-border data flow and digital sovereignty:
1. The 2020 Data Security Law of China establishes a framework for classifying data based on national security impact, and it incorporates the technical standards defined in the 2012 UNCITRAL Model Law on Electronic Commerce.
2. The 2018 Clarifying Lawful Overseas Use of Data (CLOUD) Act in the United States permits law enforcement access to data stored abroad, and it functions as a bilateral agreement under the auspices of the World Trade Organization.
3. The 2022 Data Governance Act of the European Union promotes the reuse of non-personal data across borders, and it aligns with the 2015 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because China's 2021 Data Security Law does not incorporate the 2012 UNCITRAL Model Law, which focuses on electronic contracting rather than national security-based data classification. Statement 2 is incorrect as the U.S. CLOUD Act is a domestic statute that facilitates executive agreements, not a multilateral agreement under the WTO. Statement 3 is incorrect because the 2022 EU Data Governance Act focuses on data sharing and interoperability, whereas the 2015 OECD Guidelines (which were actually updated in 2013) specifically govern personal data privacy, not the reuse of non-personal data.
Consider the following statements regarding Predictive analytics in targeted political campaigning:
1. The 2002 ePrivacy Directive of the European Union encompasses rules on the confidentiality of communications, and it established the legal framework for the 2018 GDPR requirements regarding political data processing.
2. The 2018 Data Protection Bill introduced in the Indian Parliament included provisions for a Data Protection Authority, and it was modeled after the 2016 California Consumer Privacy Act to regulate political micro-targeting.
3. The 2010 Citizens United v. FEC ruling by the U.S. Supreme Court allows for unlimited independent political expenditures, and it contains specific clauses regulating the use of predictive analytics by third-party data brokers.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the ePrivacy Directive (2002) focuses on electronic communications privacy and is distinct from the GDPR, which was not established by it. Statement 2 is incorrect as the 2018 Indian Data Protection Bill was based on the Justice Srikrishna Committee report, not the California Consumer Privacy Act, and it did not contain specific regulations for political micro-targeting. Statement 3 is incorrect because while Citizens United v. FEC (2010) permitted unlimited independent political expenditures, the ruling contains no clauses regulating predictive analytics or data brokers.
Consider the following statements regarding Digital footprinting in credit scoring models:
1. The 2016 OECD Privacy Guidelines emphasize the principle of purpose specification, and the 2021 update explicitly allows the secondary use of transactional metadata for predictive behavioral modeling in retail banking.
2. The Financial Action Task Force (FATF) Recommendation 10 outlines customer due diligence, and the 2019 guidance note permits the use of scraped web data as a primary identifier for high-risk credit profiling.
3. The Reserve Bank of India's 2022 Digital Lending Guidelines prohibit the collection of biometric data by regulated entities for the purpose of credit underwriting.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 3 is correct. Statement 1 is incorrect. Statement 2 is incorrect.
Statement 3 is correct as the RBI's 2022 Digital Lending Guidelines explicitly prohibit regulated entities from collecting biometric data for credit underwriting to prevent privacy violations. Statement 1 is incorrect because the OECD Privacy Guidelines (updated in 2013, not 2021) maintain strict purpose specification and do not authorize secondary use of metadata for predictive behavioral modeling. Statement 2 is incorrect because FATF Recommendation 10 focuses on anti-money laundering and counter-terrorist financing, and its guidance does not permit scraped web data as a primary identifier for credit profiling, which would violate data minimization principles.
Consider the following statements regarding Data fiduciary obligations in public health surveillance:
1. The 2020 Aarogya Setu protocol refers to the anonymization of location data, and this process is overseen by the National Health Authority as part of the Ayushman Bharat Digital Mission.
2. The General Data Protection Regulation of 2018 encompasses the right to be forgotten, and this provision applies to public health records held by national research institutes in all member states of the OECD.
3. The 2019 Personal Data Protection Bill proposed the creation of a Data Protection Authority of India, which functions under the administrative control of the Ministry of Health and Family Welfare.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
Statement 1 is incorrect because the Aarogya Setu protocol is overseen by the Ministry of Electronics and Information Technology (MeitY), not the National Health Authority. Statement 2 is incorrect as the GDPR applies to EU member states, not all OECD countries, and contains specific exemptions for public health research that limit the absolute application of the 'right to be forgotten.' Statement 3 is incorrect because the proposed Data Protection Authority was designed to be an independent regulator, not under the administrative control of the Ministry of Health and Family Welfare.
Consider the following statements regarding Metadata harvesting and metadata analytics:
1. The European Union's General Data Protection Regulation (GDPR), which became enforceable in May 2018, classifies pseudonymous data as personal data if it can be linked to a natural person.
2. The 2017 Justice K.S. Puttaswamy v. Union of India judgment established that the right to privacy is a fundamental right protected under Article 21 of the Indian Constitution.
3. Metadata analytics often employs predictive modeling techniques to infer sensitive information, such as political affiliation or health status, from seemingly innocuous patterns of digital activity.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct because the GDPR explicitly includes pseudonymized data under the scope of personal data if it can be re-identified through additional information. Statement 2 is correct as the landmark 2017 Puttaswamy judgment unanimously declared the right to privacy as an intrinsic part of the right to life and personal liberty under Article 21. Statement 3 is correct because metadata analytics uses behavioral patterns and machine learning to create detailed user profiles, often revealing sensitive inferences that individuals never explicitly disclosed.
Consider the following statements regarding Zero-knowledge proofs for identity verification:
1. The General Data Protection Regulation (GDPR) Article 25 emphasizes data minimization, and the 2018 European Data Protection Board guidelines identify zero-knowledge proofs as the standard encryption protocol for cross-border data transfers.
2. The European Union's eIDAS 2.0 regulation, adopted in 2024, introduces the European Digital Identity Wallet, which supports selective disclosure of attributes through zero-knowledge proof mechanisms.
3. The 2017 Puttaswamy judgment established the right to privacy as a fundamental right, and the subsequent Justice Srikrishna Committee report recommended the implementation of zero-knowledge proofs as the primary authentication method for all Aadhaar-based transactions.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 1 is incorrect. Statement 3 is incorrect.
Statement 2 is correct as the eIDAS 2.0 regulation (2024) mandates the European Digital Identity Wallet to utilize privacy-preserving technologies like zero-knowledge proofs for selective attribute disclosure. Statement 1 is incorrect because while GDPR Article 25 promotes data minimization, the EDPB has not designated zero-knowledge proofs as the mandatory standard for cross-border transfers. Statement 3 is incorrect because the Justice Srikrishna Committee report (2018) discussed privacy principles but did not mandate zero-knowledge proofs as the primary authentication method for Aadhaar, which relies on biometric and OTP-based systems.
Consider the following statements regarding Privacy-enhancing technologies (PETs) in governance:
1. Homomorphic encryption allows for computations on encrypted data without decrypting the information, a concept first proposed by Craig Gentry in his 2009 doctoral thesis.
2. The General Data Protection Regulation (GDPR), which became enforceable on May 25, 2018, includes provisions for data minimization and purpose limitation in Article 5.
3. Differential privacy, a mathematical technique for data anonymization, was implemented by the United States Census Bureau during the 2020 decennial census.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is correct.
Statement 1 is correct because Craig Gentry's 2009 breakthrough provided the first construction of a fully homomorphic encryption scheme, enabling secure computation on encrypted data. Statement 2 is correct as Article 5 of the GDPR, which became enforceable on May 25, 2018, explicitly mandates that personal data must be processed in a manner that ensures data minimization and purpose limitation. Statement 3 is correct because the U.S. Census Bureau formally adopted differential privacy for the 2020 Decennial Census to protect individual respondent confidentiality while maintaining statistical accuracy. All three statements are factually accurate, so there are no incorrect statements.
Consider the following statements regarding Technological determinism in social credit systems:
1. The 2015 OECD Recommendation on Digital Security Risk Management includes specific clauses that authorize the use of algorithmic reputation systems in the private banking sector to determine eligibility for government subsidies.
2. The 2011 UN Guiding Principles on Business and Human Rights contains provisions that address the deployment of automated surveillance technologies by private entities in the context of state-led social credit programs.
3. The 2017 Singaporean Smart Nation initiative incorporates the 'SingPass' authentication framework to provide real-time public feedback on citizen compliance with environmental regulations through a tiered scoring dashboard.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is incorrect. Statement 2 is incorrect. Statement 3 is incorrect.
All three statements are incorrect because they misattribute specific functions to international frameworks and national initiatives. The 2015 OECD Recommendation focuses on risk management principles rather than authorizing algorithmic reputation systems for subsidies, and the 2011 UN Guiding Principles provide a framework for human rights due diligence rather than regulating state-led social credit programs. Furthermore, Singapore’s SingPass is a secure digital identity gateway for accessing government services and does not function as a tiered scoring dashboard for public compliance with environmental regulations.
Consider the following statements regarding Digital footprinting in credit scoring models:
1. The 2012 White House report on Consumer Data Privacy proposed a Consumer Privacy Bill of Rights, and the subsequent 2015 executive order authorized the integration of public digital footprints into federal credit scoring algorithms.
2. The 2023 Digital Personal Data Protection Act of India defines a 'Data Fiduciary' as any person who determines the purpose and means of processing personal data.
3. The General Data Protection Regulation (GDPR) Article 22 provides individuals the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 3 is correct. Statement 1 is incorrect.
Statement 1 is incorrect because the 2012 White House report proposed a framework for privacy but never authorized the integration of public digital footprints into federal credit scoring algorithms. Statement 2 is correct as the 2023 Digital Personal Data Protection Act of India defines a 'Data Fiduciary' as any person who determines the purpose and means of processing personal data. Statement 3 is correct because Article 22 of the GDPR explicitly grants individuals the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affect them.
Consider the following statements regarding Data localization mandates under DPDP Act 2023:
1. The Data Protection Board possesses the power to issue interim injunctions against digital platforms, a provision derived from the 2021 Intermediary Guidelines and Digital Media Ethics Code.
2. Section 16 of the DPDP Act 2023 provides for the amendment of the Right to Information Act 2005, specifically regarding the disclosure of personal information.
3. The Act encompasses provisions for 'Significant Data Fiduciaries' based on user volume, utilizing the threshold of 5 million registered users established by the 2022 draft rules.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 2 is correct. Statement 1 is incorrect. Statement 3 is incorrect.
Statement 2 is correct because Section 44 of the DPDP Act 2023 amends the RTI Act to exempt personal information from disclosure if it is likely to cause unwarranted invasion of privacy, aligning it with the new data protection framework. Statement 1 is incorrect because the Data Protection Board is an adjudicatory body under the DPDP Act, and its powers are distinct from the executive powers granted to the government under the 2021 IT Rules. Statement 3 is incorrect because the DPDP Act does not specify a fixed numerical threshold like '5 million users' for Significant Data Fiduciaries; instead, it empowers the Central Government to notify such entities based on factors like volume and sensitivity of data, risk to electoral democracy, and national security.
Consider the following statements regarding Right to be forgotten vs. Public record:
1. The 2014 Court of Justice of the European Union ruling in the Google Spain case established that individuals possess a legal basis to request the removal of inadequate or irrelevant information from search engine results.
2. Article 17 of the General Data Protection Regulation (GDPR), which entered into force in May 2018, formalizes the right to erasure, allowing data subjects to request the deletion of personal data under specific conditions.
3. The 2018 Data Protection Bill introduced by the Srikrishna Committee proposed the right to be forgotten as a core feature, and this specific provision was adopted directly from the 1995 EU Data Protection Directive.
How many of the statements given above are correct?
- Only one
- Only two
- All three
- None
Explanation: Statement 1 is correct. Statement 2 is correct. Statement 3 is incorrect.
Statement 1 is correct as the 2014 Google Spain ruling affirmed that search engines are data controllers responsible for removing irrelevant or outdated personal information. Statement 2 is correct because Article 17 of the GDPR explicitly codifies the 'right to erasure' or 'right to be forgotten' within the EU legal framework. Statement 3 is incorrect because, while the Srikrishna Committee did propose the right to be forgotten, it was inspired by the modern GDPR (2018) rather than the outdated 1995 EU Data Protection Directive, which did not contain such a specific provision.