CyberCertPrepAI Security FundamentalsData Security & Privacy in AIEASYFree question
A startup's AI app stores all user prompts to improve the model. A user asks: "What data do you have about me?" Under GDPR Article 15, what must the company provide?
- A.B. Confirmation of whether their personal data is being processed, the categories and purposes of processing, any recipients, the storage period, and rights to erasure and rectification
- B.A. A summary of the user's account settings only
- C.C. The model weights that were trained on the user's data
- D.D. Only data collected in the last 90 days
Why A is correct
GDPR Article 15 (Right of Access) requires controllers to provide: (1) confirmation whether personal data is processed, (2) a copy of the personal data, (3) processing purposes, (4) categories of data, (5) recipients or categories of recipients, (6) retention period, (7) information about rights (erasure, rectification, restriction, objection, complaint). This applies to all personal data held, including prompt logs. Model weights are not personal data records. There is no 90-day limitation on the scope of access requests.
Know someone studying for AI Security Fundamentals? Send them this one.