CyberCertPrepAI Security FundamentalsData Security & Privacy in AIEASYFree question
A game studio collects detailed in-game behavioral telemetry to train a player behavior AI. A legal review notes that some behavioral patterns combined with device identifiers may constitute personal data under GDPR. What principle should guide how much telemetry is collected?
- A.Data minimization (Article 5(1)(c)) - collect only what is adequate, relevant, and limited to what is necessary for the specified AI training purpose
- B.Purpose limitation (Article 5(1)(b)) - collect all available telemetry now and define purposes later
- C.Storage limitation (Article 5(1)(e)) - delete all telemetry after 30 days regardless of training needs
- D.Integrity and confidentiality (Article 5(1)(f)) - encrypt all telemetry at rest and in transit
Why A is correct
Data minimization (Article 5(1)(c)) directly addresses how much personal data may be collected: only what is adequate, relevant, and necessary for the specific purpose. Collecting all available telemetry and defining purposes later violates purpose limitation (which requires purposes to be specified before collection, not after). Storage limitation governs retention duration, not collection volume. Integrity and confidentiality is a security principle, not a collection-scope principle.
Know someone studying for AI Security Fundamentals? Send them this one.