Data Privacy — DU B.Sc. (Hons) Computer Science Previous Year Question Papers

7. (a) Explain four ethical considerations in data collection. Describe how these ethical considerations can be addressed in practice. (8) (b) Write short notes on : (i) Active and Passive Attacks (ii) Cyber Crime Generic Elective All parts of a question must be answered together. 1. (a) Justify the statement- “Privacy and Anonymity are two sides of the same coin.” (3) (c) What do you understand by the term “Purpose Limitation” under the GDPR? (3) (d) What are the challenges in anonymizing graph data? (3) (e) State three rights available to a Data Subject under the GDPR. (3) (f) Explain how Public Key Infrastructure (PKI) is used to establish trust in the identity of a communicating party. (3) (g) Define Personal Data Breach as per the DPDP Act. Briefly explain the timeline for reporting such a breach. (3) 6. (a) Compare and contrast Privacy-by-Design (PbD) and Security-by-Design (SbD). Highlight at least four key differences in their scope, objectives, and implementation approaches within an organization. Give an example of a practice that satisfies both PbD and SbD simultaneously. (8) (b) For any robust hash function, define the following terms : (i) Pre-image Resistance (ii) Second Pre-image Resistance (iii) Collision Resistance Explain why a weakness in Collision Resistance is particularly devastating for the integrity of a system that uses digital signatures. (7) (b) What do you understand by the term CIA Triad? Explain briefly. (7) 4. (a) Encrypt the plaintext: “DEFENDTHEWALL” using the following encryption techniques : (i) Caesar-cipher with key 7 (ii) Rail-Fence cipher with 3 rails (6) (b) Describe the Model Surveillance System with the help of a diagram. (9) 5. (a) How does anonymization help in ensuring data privacy? Explain the following anonymization techniques : (9) (iii) k-anonymity (h) Why is it important to have a balance between privacy and utility? (3) (i) Explain Denial of Service (DoS) attack with the help of a suitable example. (3) (j) Why is Personally Identifiable Information (PII) considered the most sensitive type of data? An on line learning platform collects the following data from students : (3) Student Name Courses Enrolled Identify which data is PII. Justify your answer. 2. (a) Under the DPDP Act 2023, define the term Data Processor and briefly explain their responsibilities. (5) (b) Based on the case studies below, identify the relevant section(s) or key provision(s) of the DPDP Act that are violated or applicable. For each case, briefly describe the section(s) and explain why they apply. (6) (i) A health insurance company discovers that a third-party vendor hired to process claims has experienced a significant security incident exposing the health records of thousands of policyholders. The insurance company refuses to take responsibility, claiming the vendor is solely liable for the breach.