Question 1
A lead assessor is reviewing the data flow diagram of a mobile banking application. The diagram shows that the user's precise geolocation data is sent to a third-party marketing analytics provider to 'personalize offers'. This specific data flow and purpose was not disclosed in the customer-facing privacy notice. This is a direct contravention of which core privacy principle, central to the DAF-P assessment?
Answer and explanation
Correct answer: C
The principle of Transparency (often called Notice or Openness) requires organizations to be clear and open about their data processing activities. Sharing precise geolocation data with a third-party for marketing without disclosing this in the privacy notice is a direct violation of this principle. Users have not been informed about this specific use and disclosure of their personal information.
