Privacy counsel checks whether a resident chatbot’s data flows comply with applicable privacy law regimes the city follows. What governance activity is illustrated?
Select an answer to reveal the explanation.
Short Explanation
Counsel asking whether chatbot data flows match the privacy rules the city follows is governance meeting the law. You'll still coordinate chatbot notice updates with compliance review to keep disclosures current, but that's about updating notices, not checking whether the design and data flows themselves comply. Legal review belongs before launch.
Full Explanation
Privacy counsel checking whether a resident chatbot’s data flows comply with applicable privacy law regimes the city follows illustrates intersecting AI system design with privacy and legal compliance review. The correct answer is intersecting AI system design with privacy and legal compliance review. Chatbots collect prompts that may include addresses, case details, health hints, or children’s data; retention, subprocessors, cross-border transfers, and secondary use can trigger obligations under the privacy regimes the city has adopted or is subject to. Legal review before (and as) design freezes prevents building noncompliant architectures that are expensive to unwind.
Coordinating chatbot notice updates with privacy and legal compliance review fails because it focuses on keeping notices current in coordination with compliance review, not on intersecting the AI system design and its data flows with privacy and legal compliance review. Evaluating chatbot log redaction with privacy and legal compliance review fails because it narrows the review to log-redaction controls, not on intersecting the overall AI system design and data flows with privacy and legal compliance review. Assessing chatbot vendor agreements with privacy and legal compliance review fails because it limits review to vendor agreements, not the broader intersection of AI system design and its data flows with privacy and legal requirements.
Exam caveat: 'privacy law regimes the city follows' may include multiple overlapping frameworks; the exam point is that AI design must be reviewed for compliance, not that one global statute always applies identically to every municipality.
Operational check: diagram chatbot data flows (collection, storage, model vendor, logs, analytics), have privacy counsel map each flow to applicable requirements, minimize retained fields, set retention aligned to legal basis, ban secondary training on chat content unless expressly approved, and re-review on vendor or feature changes.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.