Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Data Analytics

A Pune healthcare analytics firm buys a dataset of patient records from a hospital, which it will combine with wearable-device data. Which statement is most accurate regarding the legal character of the data and its sources?

Identifiable health data remains personal data even when bought as secondary data, so data protection obligations continue to apply. Source (primary or secondary) and format (structured or not) do not create any exemption from legal duties on processing.

  1. ABecause the data is purchased secondary data, privacy obligations no longer apply to it
  2. BData from wearables is always unstructured and so outside data protection law
  3. CAnonymisation is unnecessary if the dataset is structured
  4. DHealth data identifying a person is personal data, and its processing remains subject to data protection obligations regardless of whether it is acquired as secondary dataCorrect

Explanation

Whether data is primary or secondary, or structured or not, concerns source and format, not legal status. If it identifies an individual, it is personal data and obligations such as lawful purpose and consent or other permitted ground continue. The other options wrongly link format or acquisition mode to exemption.

Did you get it right without looking?

One question tells you little. A timed set on Data Analytics shows your real accuracy, how long you take and where you lose marks.

More Data Analytics questions