Question

A retail company plans to deploy a new marketing platform that will use AI-driven behavioral profiling to score customers based on browsing history, purchase patterns, and inferred demographic data. The profiling will influence automated decisions about pricing offers shown to individual EU customers. The privacy officer must determine the first required governance action before the platform goes live. Which action should be taken?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) to evaluate the risks of the large-scale profiling and automated decision-making

Answer

Update the customer-facing privacy notice to disclose the new data uses and republish it on the website

Answer

Obtain a signed data processing agreement (DPA) from the marketing platform vendor

Answer

Encrypt the customer profile data at rest and enforce role-based access controls on the platform