AI-102 Implement computer vision solutions Practice Question
A company uses the Face API to detect and identify employees for building access. They need to ensure that the system complies with GDPR requirements for biometric data. Which action should they take?
⚠ Common exam trap
The trap here is that candidates often focus on technical security measures (encryption, deletion, anonymization) as sufficient for GDPR compliance, overlooking the foundational legal requirement for explicit consent when processing special category biometric data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain explicit consent from each employee before enrollment.
Under GDPR, biometric data (such as facial recognition templates) is classified as special category data requiring explicit consent for processing. The Face API itself does not manage consent; the responsibility lies with the application layer. Option C is correct because obtaining explicit consent from each employee before enrollment is a fundamental GDPR requirement for lawful processing of biometric data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store faces in a secure database and delete after 30 days.
Why it's wrong here
Retention policy alone does not satisfy GDPR consent requirements.
- ✗
Anonymize the face data by blurring key features.
Why it's wrong here
Blurring features destroys the biometric identifiers the Face API needs for identification, so the system stops functioning rather than becoming compliant. It is tempting because anonymisation removes GDPR applicability, and would be correct for analytics workloads where individual identification is not required.
- ✓
Obtain explicit consent from each employee before enrollment.
Why this is correct
Biometric templates derived from facial images are special-category personal data under GDPR, requiring a lawful basis beyond legitimate interest. Explicit, freely given consent from each employee before enrolment satisfies Article 9, and employees must be able to withdraw it without detriment.
- ✗
Use encryption for stored face templates.
Why it's wrong here
Encryption protects confidentiality but does not establish a lawful basis for processing biometric data, which GDPR Article 9 prohibits without explicit consent or another exemption. It is tempting because encryption is a standard security control, and would be the right answer if the question asked how to secure stored templates against unauthorised access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 761 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.