An AI risk manager at a large insurance company receives a request to deploy an AI model that uses telematics data from smartphones to assess driver risk for auto insurance. The model uses 47 features derived from smartphone accelerometer and GPS data. Which privacy risk assessment step is MOST important before deployment?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need a DPIA because continuous smartphone location and behavioral monitoring is high-risk processing of sensitive personal data. It forces you to check necessity, proportionality, consent quality, and data subject rights before deployment.
Full Explanation
A Data Protection Impact Assessment is correct because continuous smartphone-based location and behavioral monitoring represents high-risk processing of sensitive personal data that requires a full DPIA under GDPR and similar regulations. The DPIA must assess proportionality, such as whether 47-feature smartphone monitoring is necessary for the purpose, data subject rights, such as whether customers can access, correct, or delete their data, and consent quality. Verifying that smartphone data is technically encrypted during transmission to the insurance company's servers is a security control, not the primary privacy assessment step. Confirming that the 47 features do not directly include the customer's name or government ID number misses the broader privacy impact of behavioral monitoring. Ensuring the telematics data is stored in the insurance company's on-premises data center rather than a cloud environment is an operational security concern.