Module Check: Data Sovereignty
You have completed nine lessons covering the full arc of data sovereignty: the value of personal data, the mechanics of surveillance capitalism, how AI builds profiles from behavioral signals, privacy as a structural foundation, practical protection techniques, the legal landscape of data rights, footprint management, a sustainable sovereignty practice, and a hands-on audit of your own posture. This module check tests whether you can reason with these ideas — not merely recall them. The flashcards review core vocabulary. The quizzes draw from every lesson and require analysis, not just recognition. The synthesis activity asks you to apply the complete framework to a detailed scenario. Work carefully.
Flashcards — click each card to reveal the answer
Module Quizzes
A researcher publishes a dataset of 800,000 people's workout records — distance, pace, heart rate, and GPS route — with names removed. A journalist later uses the dataset to identify specific named individuals by matching their GPS routes to publicly known home and workplace addresses. Which concept from this module best explains how this re-identification was possible?
A social media platform's internal research team discovers that posts expressing outrage receive 6x more engagement than posts expressing contentment or agreement. The team recommends modifying the ranking algorithm to reduce outrage amplification. The business team rejects the change because it would reduce time-on-platform by 12%, reducing advertising revenue. From a surveillance capitalism framework, which statement best describes this decision?
An AI model trained on social media posts predicts with 79% accuracy whether a user is experiencing clinical depression, based on linguistic patterns, posting frequency, and network changes. A health insurance company purchases this prediction as a targeting signal to identify high-risk individuals for premium adjustments. Which combination of harms from this module does this application involve?
You live in Germany and request erasure of your personal data from a major social platform under GDPR Article 17. The platform responds that it cannot erase your data because it is necessary for 'the performance of a task carried out in the public interest.' You believe this justification is not legitimate. What is your correct next step?
You discover that a data broker has a profile on you that includes your home address, estimated income, health interests (inferred from browsing), and political affiliation (inferred from consumer behavior). You submit an opt-out request. Six months later, a friend searches your name on the same site and finds the profile is back. What is the most accurate explanation?
A classmate argues: 'I already gave up my privacy when I joined social media at age 13 — there is no point trying to protect it now.' Using concepts from this module, construct the most complete counter-argument.
Capstone Synthesis: The Connected School
- Read the following scenario carefully. Your response should apply concepts from every lesson in this module.
- --- THE SCENARIO ---
- A school district proposes the 'Connected School' initiative. Every student will be issued a school device and account. The device will run an AI-powered 'attention monitoring' system that uses the front-facing camera to track eye gaze and infer whether students are paying attention during class. The system will also analyze typing patterns and search queries on school devices to build a 'learning engagement profile' for each student. This profile will be shared with the student's teachers and — in aggregate, de-identified form — with an EdTech company that helped develop the system. The EdTech company's contract states that it may use aggregated data to improve its products. The district's privacy officer says the system is covered by FERPA and therefore fully compliant.
- --- YOUR ANALYSIS ---
- Address each of the following in a structured written response:
- 1. Data production map: What categories of personal data does this system collect? Classify each type (behavioral, biometric, inferred, etc.). Which data points are most sensitive and why?
- 2. Mosaic and inference risk: Even if the 'aggregate de-identified' data shared with the EdTech company contains no names, explain why this may not provide meaningful privacy protection for students.
- 3. Chilling effect: How might the attention monitoring system affect student behavior, learning, and identity development — specifically using the concept of the chilling effect and solitude as a component of privacy?
- 4. Surveillance capitalism concern: Is the EdTech company's data use consistent with a surveillance capitalism business model? What specific data uses would you want prohibited in the contract, and why?
- 5. Legal rights analysis: Is the district's FERPA compliance claim sufficient? What does FERPA actually cover and not cover in this scenario? What additional protections might apply depending on where the district is located?
- 6. Threat model for a student: Construct a brief threat model for a student in this district. Who are the realistic adversaries, what data is most at risk, and what practical steps could a student and their family take within this system?
- 7. Reform recommendation: Write a one-paragraph recommendation to the school board explaining what changes to the initiative are necessary before it should be approved. Be specific and address the concerns you identified.
- This is a synthesis task. Draw on Lessons 1 through 9. Your analysis should be precise, grounded in the concepts from this module, and actionable — not a general complaint about technology in schools.