Question

A retailer plans to deploy an AI-driven system that continuously analyzes in-store video feeds combined with loyalty-card purchase history to profile individual shoppers and predict future buying behavior at scale. The privacy engineer must advise the project team on the required first step before development proceeds. Which action is MOST appropriate?

Accepted Answer

Conduct a data protection impact assessment (DPIA) because the processing involves systematic, large-scale profiling likely to result in high risk to individuals

Answer

Proceed with development and perform a DPIA only if a data subject files a complaint about the profiling

Answer

Document the processing in the records of processing activities and rely on that as sufficient risk analysis

Answer

Obtain cyber-liability insurance to transfer the residual privacy risk before deployment