Business Analytics Quiz: Ethics And Privacy
10 questions · exam conditions
0:00
Ethics And PrivacyQuestion 1 of 10

A grocery chain collected loyalty-card purchases after telling customers that the data would be used to provide discounts and improve store inventory. The analytics team later proposes combining identifiable purchase histories with data from an insurance partner to predict customers' health risks. The resulting scores would be sold back to the insurer.

Which action would most directly address the primary ethical deficiency before the proposed analysis proceeds?

Encrypt the combined files during transfer and restrict access to analysts who have completed privacy training.
Obtain meaningful consent for the new purpose and limit the transferred variables to those demonstrably necessary.
Replace customer names with stable identification numbers while preserving detailed purchase histories for model development.
Allow the analysis because customers originally agreed to both personalized discounts and inventory improvement activities.
← Back to quizzes

Business Analytics Quiz

Business Analytics Quiz: Ethics And Privacy

Practice Ethics And Privacy in Business Analytics with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Ethics And Privacy, giving you a quick way to practice the rules, question types, and explanations that matter most for Business Analytics.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A grocery chain collected loyalty-card purchases after telling customers that the data would be used to provide discounts and improve store inventory. The analytics team later proposes combining identifiable purchase histories with data from an insurance partner to predict customers' health risks. The resulting scores would be sold back to the insurer.

Which action would most directly address the primary ethical deficiency before the proposed analysis proceeds?

  1. Encrypt the combined files during transfer and restrict access to analysts who have completed privacy training.
  2. Obtain meaningful consent for the new purpose and limit the transferred variables to those demonstrably necessary. (correct answer)
  3. Replace customer names with stable identification numbers while preserving detailed purchase histories for model development.
  4. Allow the analysis because customers originally agreed to both personalized discounts and inventory improvement activities.
Explanation: When you encounter a question about data ethics, focus on two foundational principles: purpose limitation (data collected for one purpose shouldn't be repurposed without authorization) and informed consent (people must agree to how their data is actually used). This scenario is a textbook violation of both — customers consented to discounts and inventory management, not health-risk scoring sold to insurers. B is correct because it directly repairs both deficiencies. Obtaining meaningful consent ensures customers knowingly agree to the new, sensitive purpose. Limiting transferred variables to only what's necessary applies data minimization, reducing harm and privacy exposure. Together, these steps make the proposed analysis ethically defensible before it begins. A addresses security during data transfer, which is a worthwhile technical control — but encryption and access restrictions don't fix the fundamental problem that customers never agreed to this use. You can securely misuse data. C is a classic trap. Replacing names with stable ID numbers is pseudonymization, not true anonymization. Detailed purchase histories (especially combined with insurance data) can still re-identify individuals. This cosmetic change leaves the consent violation completely intact. D misreads the original agreement. Customers consented to personalized discounts and inventory improvement — not health profiling or sharing data with a third-party insurer for commercial resale. Stretching consent language to cover fundamentally different purposes is exactly what ethical frameworks prohibit. Your study tip: when a question describes a repurposing of data, immediately ask "did the original consent cover this new use?" If not, no technical safeguard (encryption, pseudonymization) substitutes for obtaining proper consent first.

Question 2

A hiring team removes race and ethnicity from a predictive model. The model still uses postal code, commuting distance, university attended, and participation in employee-referral networks. Validation shows similar overall accuracy across demographic groups, but qualified applicants from one group receive substantially more false rejections.

What is the most appropriate next step before deployment?

  1. Deploy the model because excluding protected attributes and obtaining similar overall accuracy are sufficient safeguards.
  2. Remove every variable correlated with group membership, regardless of its relevance to job performance or error rates.
  3. Audit proxy effects and group-specific error rates, then revise features or thresholds based on job-related validity. (correct answer)
  4. Increase the training sample without examining subgroup outcomes, because more records will necessarily eliminate the disparity.
Explanation: When a predictive model uses variables that correlate strongly with protected characteristics — like postal code or university attended — those variables can act as proxies for race or ethnicity even after the protected attributes themselves are removed. This is the core concept being tested: disparate impact through proxy variables. Whenever you see a scenario where protected attributes are excluded but group-specific error rates still diverge, your alarm should trigger around proxy effects and fairness auditing. Option C is correct because it addresses the actual problem systematically. Similar overall accuracy masks the real issue: one group suffers substantially more false rejections, meaning qualified candidates are being screened out at a higher rate. The right response is to audit which features are driving those group-specific errors, assess whether those features have genuine job-related validity, and then adjust features or decision thresholds accordingly. This balances legal compliance, ethical fairness, and predictive usefulness. Option A is wrong because overall accuracy parity is not a sufficient fairness standard. Aggregate metrics can hide serious subgroup disparities — this is sometimes called the "accuracy paradox." Excluding protected attributes alone does not eliminate proxy discrimination. Option B overcorrects dangerously. Removing every variable correlated with group membership could strip out legitimate, job-relevant predictors, gutting the model's usefulness. The goal is not zero correlation with group membership but rather justified, job-related validity. Option D is a common misconception: more data does not automatically fix a biased feature set. If a proxy variable is structurally biased, scaling the data only entrenches the disparity further. Study tip: On fairness questions, always distinguish between overall accuracy and subgroup error rates — they can tell completely different stories, and exams will exploit that gap.

Question 3

A subscription company conducts an A/B test on cancellation screens. The control permits cancellation after one confirmation. The treatment repeatedly changes button wording and placement based on behavioral data until some users abandon the cancellation attempt. The company reports a higher short-term retention rate, but it does not measure complaints, unintended renewals, or customer understanding.

Which recommendation best reflects responsible experimentation?

  1. Adopt the treatment because random assignment establishes that the observed retention increase was caused by the new screen.
  2. Continue the experiment until statistical significance is stronger, while retaining short-term subscription retention as the sole outcome.
  3. Redesign the treatment to preserve informed choice and evaluate unintended renewals, comprehension, and complaints before adoption. (correct answer)
  4. Use the treatment only for customers predicted to cancel, because targeting reduces the ethical concern created by manipulation.
Explanation: When you see a question about A/B testing that involves potentially manipulative design, shift your thinking beyond statistical validity toward ethical experimentation standards. Responsible experimentation requires measuring a full picture of outcomes — not just the metric that flatters the treatment. The treatment here uses dynamic interface manipulation (repeatedly shifting button placement and wording) to frustrate users into abandoning cancellation. Even if random assignment is valid, the design undermines informed choice. Option C is correct because it addresses both problems simultaneously: it calls for redesigning the treatment to restore user autonomy and expanding measurement to include unintended renewals, comprehension, and complaints. These "hidden" outcomes are exactly what responsible experimenters must capture before scaling a result. Option A is a classic trap. Random assignment does establish causality, but causality alone doesn't justify adoption — it only tells you that the screen caused retention, not whether the retention is legitimate or ethically acceptable. Option B compounds the problem by doubling down on a flawed experiment: extending runtime while keeping a single biased metric doesn't improve the study's integrity, it just accumulates more evidence of a metric that obscures harm. Option D is perhaps the most seductive distractor — targeting sounds like harm reduction, but applying a manipulative design selectively doesn't make the manipulation ethical; it just narrows the population being deceived. Study tip: On business analytics questions involving experimentation ethics, watch for answers that conflate statistical rigor with ethical soundness. A well-designed experiment can still be irresponsible if it measures only favorable outcomes and ignores consumer harm signals.

Question 4

A bank uses a vendor's predictive model to deny some small-business loans. The vendor provides a risk score but refuses to disclose any decision factors, citing trade-secret protection. Bank employees cannot explain adverse decisions or correct an applicant's inaccurate input data, although a loan officer formally clicks an approval button after each model recommendation.

Which change would best improve accountability without assuming that the bank must publish the vendor's full model?

  1. Require actionable reason codes, input-correction procedures, audit access, and meaningful human authority to reconsider decisions. (correct answer)
  2. Keep the current process because a loan officer's final click constitutes meaningful human oversight, satisfying accountability requirements regardless of the officer's actual ability to review the underlying factors.
  3. Publish only the model's overall accuracy metrics, because strong aggregate performance across a large portfolio makes individual-level explanations and correction mechanisms unnecessary for regulatory purposes.
  4. Replace the vendor with any simpler rule-based model, because transparency through simplicity automatically satisfies accountability obligations even without separate validation or governance procedures.
Explanation: When you see a question about AI-driven decisions in regulated industries, focus on the core pillars of accountability: explainability, correctability, auditability, and genuine human authority. The passage highlights a system where none of these exist — the vendor hides its logic, errors can't be corrected, and the loan officer's "click" is ceremonial rather than substantive. Answer A is correct because it directly addresses every gap the passage identifies. Actionable reason codes give applicants and officers meaningful explanations. Input-correction procedures fix the problem of unresolvable data errors. Audit access lets regulators and the bank verify model behavior over time. Most importantly, meaningful human authority to reconsider decisions transforms the loan officer's role from rubber-stamp to genuine checkpoint — all without requiring the vendor to expose proprietary model internals. Answer B is the most dangerous distractor because it describes exactly the flawed status quo and reframes it as adequate. A click that the officer cannot meaningfully exercise is not oversight — it's theatrical compliance. Regulators and frameworks like the EU AI Act specifically distinguish between nominal and substantive human review. Answer C confuses portfolio-level accuracy with individual-level accountability. Strong aggregate metrics tell you nothing about whether a specific applicant was scored on bad data or deserves reconsideration. Individuals aren't averages. Answer D assumes that model simplicity automatically equals accountability. Simpler models can still be ungoverned, unvalidated, and unexplained — transparency of structure doesn't substitute for process-level governance. The key study tip: watch for questions where a procedural gesture (a click, a metric, a model swap) is presented as a substitute for substantive accountability mechanisms. Real accountability requires explainability, correction, oversight, and audit — together.

Question 5

A lender audits a predictive approval model. In group X, 6464 of 8080 applicants who later proved creditworthy were approved; overall, 8888 of 200200 applicants were approved. In group Y, 4040 of 5050 applicants who later proved creditworthy were approved; overall, 4545 of 100100 applicants were approved.

Based only on these results, which statement is supported?

  1. The model satisfies equal opportunity in this sample, but it does not have exactly equal overall approval rates. (correct answer)
  2. The model satisfies demographic parity in this sample, but its true-positive rates differ between the groups.
  3. The model violates equal opportunity because group X has more approved creditworthy applicants in absolute terms.
  4. The model is ethically fair because equal true-positive rates are sufficient to establish fairness under every criterion.
Explanation: Whenever you see a fairness question about a predictive model, your first move should be to calculate the two key metrics separately: the true-positive rate (TPR) for equal opportunity, and the overall approval rate for demographic parity. Here, the TPR (approved among creditworthy applicants) for group X is 6480=0.80\frac{64}{80} = 0.80, and for group Y it is 4050=0.80\frac{40}{50} = 0.80. The rates are identical, so the model satisfies equal opportunity — it gives creditworthy applicants the same approval chance regardless of group. Now check overall approval rates: group X has 88200=0.44\frac{88}{200} = 0.44 and group Y has 45100=0.45\frac{45}{100} = 0.45. These differ slightly, meaning demographic parity is not met. That combination is exactly what answer A describes, making it the supported conclusion. Answer B gets the facts backwards — it claims demographic parity is satisfied and TPRs differ, but the data show the opposite on both counts. Answer C confuses absolute counts with rates. Yes, group X had more creditworthy applicants approved in raw numbers (64 vs. 40), but equal opportunity is measured with proportions, not totals; the 80% rate is the same in both groups. Answer D overstates what equal TPRs can prove. Equal opportunity is one fairness criterion among several (demographic parity, calibration, etc.), and no single metric is universally sufficient to declare a model "ethically fair." Study tip: Always distinguish between rate-based metrics (TPR, precision) and count-based comparisons — exams frequently use large vs. small group sizes as a trap to make equal rates look unequal in absolute terms.

Question 6

Before releasing a customer dataset to researchers, a company removes names and account numbers. Using age band, city, and household size as quasi-identifiers, the remaining records form equivalence groups containing 55, 44, 33, and 22 customers. Company policy requires the released dataset to satisfy 33-anonymity.

Which conclusion is most accurate?

  1. The dataset satisfies the policy because every direct identifier has been removed before the records are released.
  2. The dataset satisfies the policy because most customers belong to groups containing at least 33 records.
  3. The dataset fails the policy; the two-record group must be suppressed or generalized, although compliance would not prevent every inference. (correct answer)
  4. The dataset fails the policy; every equivalence group must contain exactly 33 records after generalization.
Explanation: Whenever you see a question involving anonymization, think about k-anonymity: a dataset satisfies kk-anonymity if every equivalence group (a cluster of records sharing the same quasi-identifier values) contains at least kk records. The threshold applies universally — no exceptions. Here, the company requires 33-anonymity, meaning every group must have ≥3\geq 3 records. The groups contain 55, 44, 33, and 22 customers. Three of the four groups meet the threshold, but the two-record group does not. Because kk-anonymity is only satisfied when all groups comply, the policy is violated. To fix this, the company must either suppress (remove) the two offending records or generalize the quasi-identifiers until that group merges with others and reaches size 33. Crucially, even after achieving compliance, an attacker who knows someone belongs to a small group can still make probabilistic inferences — so 33-anonymity limits, but does not eliminate, re-identification risk. This makes C the correct conclusion. A is wrong because removing direct identifiers (names, account numbers) is only the first step. Quasi-identifiers — combinations like age band, city, and household size — can still re-identify individuals, which is exactly what k-anonymity addresses. B commits a "majority rules" fallacy. K-anonymity is an all-or-nothing standard; if even one group falls below kk, the entire dataset fails, regardless of how many other groups comply. D is wrong because k-anonymity requires groups of at least kk records, not exactly kk. Groups of 55 or 44 are perfectly acceptable. Study tip: On anonymization questions, always check the minimum group size — if any single group falls below the threshold, the whole dataset fails.

Question 7

A retailer records customer-service calls for quality review. After completing that review, it retains identifiable audio and full transcripts indefinitely because analysts may someday develop new language models. Most current dashboards use only issue category, resolution time, and sentiment score. Some records are subject to documented legal holds.

Which retention policy best applies data-minimization and purpose-limitation principles?

  1. Retain all identifiable recordings indefinitely because possible future analytics creates a continuing operational purpose.
  2. Delete every recording immediately after scoring, including records covered by legal holds or unresolved disputes.
  3. Keep the full transcripts permanently but remove customer names, because text cannot reveal identity after direct identifiers are removed.
  4. Set justified deletion periods, retain only needed derived fields, and separately preserve records subject to valid legal holds. (correct answer)
Explanation: When you encounter a data-governance question like this, anchor your thinking to two core privacy principles: data minimization (collect and keep only what you actually need) and purpose limitation (use data only for the specific purpose it was collected for). Any retention policy must satisfy both simultaneously — not trade one off against the other. Option D does exactly this. It sets justified, time-bound deletion schedules tied to real business needs, retains only the derived fields (category, resolution time, sentiment score) that analysts actually use, and carves out a narrow exception for records under valid legal holds. This approach honors both principles without sacrificing legitimate compliance obligations. The distractors each fail in a specific way. A is the classic "future analytics" trap — claiming that speculative, undefined future uses constitute a current operational purpose. Purpose-limitation explicitly prohibits retaining data for vague hypothetical reasons; a purpose must be documented and specific, not aspirational. B swings too far in the opposite direction: while aggressive deletion seems privacy-friendly, immediately deleting records under legal holds or unresolved disputes violates legal preservation obligations. Minimization doesn't mean destroying evidence you're legally required to keep. C reflects a common misconception about anonymization — removing direct identifiers like names is not sufficient to prevent re-identification when full transcripts remain. Voice patterns, specific complaint details, and contextual clues can all reveal identity, so this approach fails the minimization standard. Your study tip: on data-governance questions, watch for answers that treat retention as all-or-nothing. The correct policy almost always involves proportionality — keeping what you need, for as long as you need it, with documented exceptions for legal requirements.

Question 8

A company permits an analytics team to spend a total differential-privacy budget of ε=1.00\varepsilon=1.00 on a customer dataset. The team has already released two statistics using mechanisms with privacy costs of ε=0.35\varepsilon=0.35 and ε=0.40\varepsilon=0.40. It proposes a third release costing ε=0.30\varepsilon=0.30 on the same individuals.

Under basic sequential composition, which assessment is correct?

  1. The release is permitted because each individual query has a privacy cost below ε=1.00\varepsilon=1.00.
  2. The release is permitted because only the largest query cost, ε=0.40\varepsilon=0.40, counts toward the budget.
  3. The release exceeds the budget by ε=0.30\varepsilon=0.30 because the full budget was consumed by the first two queries.
  4. The release exceeds the budget by ε=0.05\varepsilon=0.05, so its cost must be reduced or another release omitted. (correct answer)
Explanation: Whenever you see a question involving differential privacy and multiple data releases, your instinct should be to apply sequential composition: when you run several privacy mechanisms on the same individuals, the total privacy cost is the sum of all individual costs — not the maximum, not just the largest. Here, the team has already spent ε1+ε2=0.35+0.40=0.75\varepsilon_1 + \varepsilon_2 = 0.35 + 0.40 = 0.75 of the ε=1.00\varepsilon = 1.00 budget. That leaves a remaining allowance of 1.00−0.75=0.251.00 - 0.75 = 0.25. The proposed third release costs ε3=0.30\varepsilon_3 = 0.30, which exceeds that remaining allowance by 0.30−0.25=0.050.30 - 0.25 = 0.05. So the release is impermissible unless its cost is trimmed or a prior release is dropped — making D the correct assessment. Choice A is wrong because the rule is never "each query stays under the total budget individually." That interpretation ignores the accumulation of privacy risk across queries; every release chips away at the same pool of protection for the same people. Choice B describes a parallel composition rule, which applies only when queries target disjoint subsets of the data. Since all three releases concern the same individuals, parallel composition does not apply, and you cannot take just the maximum cost. Choice C overstates the damage. The first two queries cost 0.750.75, not the full 1.001.00, so 0.250.25 of budget remains. Claiming the budget is fully consumed — and therefore the overage is 0.300.30 — is an arithmetic error. Study tip: Always check whether queries share the same individuals (use summation) or cover disjoint groups (use maximum). Confusing parallel and sequential composition is the most common trap on differential-privacy exam questions.

Question 9

An internal workforce dashboard suppresses any result based on fewer than 1010 employees. A manager can still request the same metric for an entire department and then request it again after excluding one small team. Subtracting the two displayed values can reveal the small team's result.

Which control would most directly mitigate this privacy weakness while preserving useful aggregate reporting?

  1. Increase password complexity for managers without changing which overlapping dashboard queries may be submitted.
  2. Apply complementary suppression or query-overlap controls so allowed aggregates cannot expose a suppressed subgroup by subtraction. (correct answer)
  3. Replace employee names with identification numbers before calculating the same unrestricted overlapping aggregates.
  4. Display department results with additional decimal places so managers cannot easily estimate the suppressed team's value.
Explanation: When a dashboard suppresses small-group results but still allows managers to query overlapping aggregates freely, a differencing attack becomes possible: subtract the "department minus team" value from the full department value to reconstruct exactly what was supposed to be hidden. The suppression threshold alone is meaningless if the system doesn't also block the queries that make subtraction possible. This question tests your understanding of statistical disclosure control in data privacy. B is correct because complementary suppression (or query-overlap restrictions) directly closes the differencing loophole. These controls either suppress additional related cells so no subtraction can isolate the protected group, or restrict which combinations of overlapping queries a user may submit — preserving meaningful aggregate reporting while eliminating the mathematical path to re-identification. A is wrong because password complexity is an authentication control, not an authorization or query-logic control. A manager with a stronger password still has the same ability to run the two overlapping queries and subtract them — the vulnerability is structural, not credential-based. C is wrong because replacing names with ID numbers is a pseudonymization step that protects direct identifiers. It does nothing to prevent the differencing attack, since the attack exploits numeric aggregate values, not employee names. D is wrong because adding decimal places is cosmetic obfuscation, not a true control. A determined manager can still subtract two precise-looking numbers; more decimal places may even make the reconstructed value more accurate, worsening the exposure. The study takeaway: whenever a question describes a differencing or subtraction attack on suppressed data, the fix must address the query overlap itself — not access credentials, not identifier masking, and not display formatting.

Question 10

A retailer builds a prescriptive model to allocate a limited retention budget. The objective maximizes predicted next-quarter revenue. Because historical campaigns concentrated on affluent neighborhoods, the model recommends sending nearly all offers there and none to several lower-income areas. Offline validation confirms the revenue predictions but does not estimate access, long-term learning, or group-level effects.

What is the most responsible next step before using the recommendations?

  1. Deploy the allocation because validated revenue maximization is sufficient when the available budget is objectively limited.
  2. Add explicit access or fairness constraints, test sensitivity and long-term effects, and document the resulting trade-offs. (correct answer)
  3. Allocate identical spending to every neighborhood, because equal resource amounts are always the only ethically valid solution.
  4. Remove neighborhood labels while leaving historical response variables unchanged, then accept the resulting allocation as neutral.
Explanation: When a prescriptive model optimizes a single objective — like revenue — without constraints, it will ruthlessly exploit whatever patterns exist in historical data, even if those patterns reflect past discrimination or systemic exclusion. That's exactly what's happening here: the model learned from biased campaign history and is now recommending that bias be repeated at scale. Responsible deployment requires recognizing that validating revenue predictions alone is not enough to call a model "ready." B is correct because it addresses the full picture. Adding fairness or access constraints forces the model to balance revenue against equitable reach. Sensitivity analysis reveals whether small budget shifts dramatically change group-level outcomes, and testing long-term effects guards against compounding harm. Documenting trade-offs ensures decision-makers understand what is being sacrificed for what gain — which is essential for accountability. A is wrong because budget constraints being "objective" doesn't make the allocation ethical. Limited resources make prioritization choices more consequential, not less — precisely because someone is actively being excluded. Validation of revenue predictions says nothing about fairness or systemic harm. C is wrong because equal amounts aren't automatically equitable. Equal spending ignores differing neighborhood sizes, needs, or baseline access levels. Mandating identical allocation regardless of context is a rigid rule masquerading as ethics and may actually produce worse outcomes for underserved groups. D is wrong because removing neighborhood labels while keeping historical response variables is a classic fairness theater trap. Correlated variables (income proxies, zip-code features) will reconstruct the same biased recommendations through the back door. Study tip: When a question involves optimization models trained on historical data, always ask: what did history exclude, and does the model perpetuate that? Fairness constraints and trade-off documentation are the responsible answer almost every time.