Examkin

Soru

Zorluk: ZorData Privacy and Compliance Regulations

A systems administrator at an international software company is configuring a telemetry platform that collects IP addresses, account usernames, and usage logs from clients residing in the European Union. A developer proposes applying a SHA-256 cryptographic hash to these identifiers prior to storage and processing without obtaining user consent, claiming that hashed data is fully anonymized and exempt from data privacy laws. Which of the following best evaluates this proposal under the General Data Protection Regulation (GDPR)?

  1. The proposal is non-compliant because pseudonymized data (such as hashed identifiers) remains personal data under GDPR and still requires a lawful basis for processing.Cevap
  2. B
    The proposal is compliant because hashing permanently transforms PII into anonymized data, exempting the dataset from GDPR enforcement.
  3. C
    The proposal is compliant because encrypting or hashing user network telemetry automatically reclassifies the records under PCI-DSS standards rather than GDPR.
  4. D
    The proposal is non-compliant because hashing online network identifiers converts standard user telemetry into Protected Health Information (PHI).

Cevap

The proposal is non-compliant because pseudonymized data (such as hashed identifiers) remains personal data under GDPR and still requires a lawful basis for processing.
Under GDPR, personal data includes online identifiers such as IP addresses and account usernames. Replacing direct identifiers with cryptographic hashes is considered pseudonymization rather than full anonymization. Because pseudonymized data can still be linked back to individual subjects through cross-referencing or dictionary attacks, it remains fully subject to GDPR regulations and requires a lawful basis for processing.

Adım Adım Çözüm

1
Analyze the data type being collected.
IP addresses, usernames, and usage logs linked to EU citizens constitute Personally Identifiable Information (PII) under GDPR scope.
GDPR broadly defines personal data as any information relating to an identified or identifiable natural person.
2
Evaluate the technical measure (SHA-256 hashing) against GDPR definitions.
Hashing replaces identifiers with pseudonyms but does not render the data irreversibly anonymous, placing it in the category of pseudonymized data.
Recital 26 of GDPR explicitly states that personal data which has undergone pseudonymization remains personal data.
3
Determine compliance requirements.
Because pseudonymized data remains personal data under GDPR, processing it without a valid legal basis (such as consent or legitimate interest) violates compliance.
Organizations must adhere to GDPR principles for all personal data regardless of whether pseudonymization techniques were applied.

Anahtar Kavram

GDPR Scope and Pseudonymization vs. Anonymization
Bu soruyu puanla

Konular

Data Privacy and Compliance Regulations

Bu konudan daha fazla soru