Week 19 self-check | AI GRCA Practice Lab

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Why is 'human review vs rubber-stamping' a recurring theme across both ISO/IEC 42001 oversight controls and UK GDPR ADM safeguards?

Only ISO 42001 addresses this concern; GDPR does notIt's coincidental and has no shared underlying principleBoth frameworks recognise that nominal human presence without real engagement fails to provide genuine protection against automated harmGDPR and ISO 42001 define 'meaningful review' completely differently with no overlap

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

What does DPIA screening determine?

Whether the model is generative or classic AIWhether the vendor is profitableWhether the processing is likely high risk and needs a full DPIAWhether consent is always required

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

What should a plain-language AI privacy notice for an automated decision include?

The model's source codeA guarantee of accuracyOnly the vendor's nameRelevant data use, the decision's effect, safeguards and how to challenge it

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

How does 'fairness' as a UK GDPR principle differ from simply having a lawful basis for processing?

Only lawfulness matters; fairness is not a separate UK GDPR principleThey are identical requirementsFairness concerns whether processing is reasonably expected and not unduly detrimental to the individual, which is a distinct question from whether a lawful basis technically existsFairness has no independent meaning beyond lawfulness

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

What would a 'right of access' request typically entitle someone to, regarding an AI-scored decision about them?

Confirmation that their data is being processed and access to relevant information about that processing, including relevant automated decision-making detailsOnly the right to complain to a regulator, not to see their own dataThe right to delete the AI model itselfNothing related to the AI processing

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Processing criminal offence data for an AI-driven vetting tool requires:

No additional condition beyond a standard lawful basisAn additional specific condition under UK data protection law, beyond the standard lawful basis and special category rulesThis type of data cannot be processed under any circumstancesOnly consent is ever a valid basis for this data type

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Which of these is a 'special category' of data under UK GDPR?

A person's postcodeData concerning healthA person's job titleA person's employer name

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Why are 'vulnerable groups' given specific attention in AI and privacy guidance?

Only children count as a vulnerable group under any circumstancesVulnerability is irrelevant to privacy risk assessmentVulnerable groups require no special consideration under UK GDPRThey may be less able to understand, exercise rights over, or challenge how an AI system processes their data, warranting extra protective consideration

WEEK 19 · AI law & privacy · UK GDPR, DUAA, DPIA and AI Privacy

Which lawful basis is most likely appropriate for processing necessary to decide whether to enter a loan contract a customer has requested?

ContractPublic taskLegitimate interests only, never contractConsent