@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix edu: <https://knobit.org/def/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix schema: <https://schema.org/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

<https://knobit.org/id/task/dso-evaluation-environments/C2> a edu:Question ;
    rdfs:label "C2 (3 points)"@en ;
    dcterms:license <https://creativecommons.org/licenses/by/4.0/> ;
    owl:sameAs <https://bitbucket.org/reffa/ontology/id/task/dso-evaluation-environments/C2> ;
    schema:hasPart <https://knobit.org/id/register/data-storage-operations#SO-250>,
        <https://knobit.org/id/register/data-storage-operations#SO-251>,
        <https://knobit.org/id/register/data-storage-operations#SO-252> ;
    schema:identifier "C2" ;
    schema:position 2 ;
    schema:text "Production data in non-production environments. (a) 1 point: EV-22 is called anonymised but is pseudonymised - the HMAC key sits in the environment's own vault, tokens are consistent, and date of birth, postcode and dispute notes remain, so whoever has the environment can re-link records to people: it is still personal data (GDPR recital 26). The fix keeps the key outside the environment (or uses synthetic data), removes or generalises the quasi-identifiers, and has each refresh approved by the card data owner instead of 'not required'. (b) 0.5 each: data minimisation - EV-22 keeps only the 12 columns the models use (plus keys), not all 46; storage limitation - the indefinite monthly snapshots get a defined retention tied to the purpose, then deletion. (c) 1 point: EV-23 put three months of unmasked production card data into the vendors' tenants to test technology - a purpose not compatible with the one the data was collected for (GDPR Art. 5(1)(b), Art. 6(4)), approved by the sponsor rather than the data owner: the answer replaces it with synthetic or properly de-identified data and has the copies deleted now that the proof of concept ended on 2026-09-12, not kept until the contract decision."@en .

edu:Question rdfs:label "Question"@en,
        "Küsimus"@et .

<https://knobit.org/id/register/data-storage-operations#SO-250> rdfs:label "dso-evaluation-environments C2: pseudonymised training data labelled anonymised"@en .

<https://knobit.org/id/register/data-storage-operations#SO-251> rdfs:label "dso-evaluation-environments C2: minimisation and storage limitation of training data"@en .

<https://knobit.org/id/register/data-storage-operations#SO-252> rdfs:label "dso-evaluation-environments C2: production card data copied to vendors for an incompatible purpose"@en .