The privacy office runs a DPIA-style review before facial analytics in a non-law-enforcement facilities pilot and may cancel the project. What responsible practice is illustrated?

The privacy office running a DPIA-style review before facial analytics in a non-law-enforcement facilities pilot—and retaining authority to cancel—illustrates impact assessment with willingness to stop risky civic AI before launch. The correct answer is impact assessment with willingness to stop risky civic AI before launch. Facial analytics raises biometric privacy, function-creep, and discrimination risks even outside policing. A Data Protection Impact Assessment-style review examines necessity, proportionality, data flows, retention, and residual risk; canceling when risks cannot be mitigated is a success of governance, not a failed pilot. Bias assessment with willingness to stop risky civic AI before launch fails: assessing bias and being willing to stop covers fairness but does not substitute for a full DPIA covering necessity, proportionality, data flows, retention, and residual risk or the privacy office's authority to cancel based on overall impact before launch. Transparency review with willingness to stop risky civic AI before launch fails: reviewing transparency and being willing to stop improves openness but does not replace the required full impact assessment and go/no-go decision. Retention assessment with willingness to stop risky civic AI before launch fails: assessing retention and being willing to stop addresses storage limits but does not satisfy the duty to assess overall impact and authorize the system with willingness to stop if residual risk is unacceptable. Exam caveat: DPIA-style review is not automatically a ban on all facial analytics. The tested practice is assessing impact and being willing to stop; some narrowly scoped, consented, non-surveillance uses might pass—but narrow assessments like bias assessment, transparency review, or retention assessment alone never replace the full pre-launch review and go/no-go decision. Operational check: complete a written impact assessment covering purpose limitation, retention, access controls, and function-creep bans; require privacy office go/no-go before camera analytics activate; document cancellation rationale when residual risk is unacceptable; and prohibit silent expansion into new use cases without a fresh review.