Discuss IAPP AIGP Exam Topic 1 Question 50

CASE STUDY

A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources.

The data processed by the AI system would be classified as:

ANon-sensitive personal data, since it does not reveal information about health, gender or race

BOrganizational data, since it is part of the authentication process

CNon-personal data, as long as it is not linked to a user ID

DSpecial category data, if it can be used to uniquely identify a person

Suggested Answer: D

The correct answer is D. Key stroke dynamics, used to identify individuals, fall under biometric data, which is a special category of personal data under the GDPR and other frameworks.

From the AI Governance in Practice Report 2025:

''Keystroke dynamics may constitute biometric data if used to uniquely identify an individual... Biometric data is classified as special category personal data and requires higher protection standards.''

Also reflected in ILT Participant Guide:

''Biometric data, such as facial images, voiceprints, iris scans or keystroke patterns, are treated as special category data when they are used for the purpose of uniquely identifying individuals.''

Get Premium AIGP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

16 comments · newest first

Margurite 4 days ago

I think it's D. The typing patterns can uniquely identify someone.

Lang 10 days ago

I agree with B. It’s crucial for protecting resources.

Willard 15 days ago

D is valid too. User profiles can be sensitive.

Jamal 20 days ago

B makes sense. It’s organizational data for security.

Louvenia 25 days ago

A seems too simplistic. It’s more than just non-sensitive data.

Carma 1 month ago

I lean towards D. It can uniquely identify someone.

Clare 1 month ago

I think it's definitely B. It's part of the authentication process.

Tyra 1 month ago

Not sure if it's non-personal data if it tracks typing patterns.

Joseph 2 months ago

Totally agree with Nickie, it's about security!

Shawnda 2 months ago

Wait, isn't this a bit invasive?

Nickie 2 months ago

I think it's organizational data since it's for authentication.

King 2 months ago

This data definitely seems like it could identify a person.

Ricarda 2 months ago

I think option D could be correct if the typing data is unique enough to identify someone. But I’m also considering option C, especially if it’s not linked to a user ID.

Ines 2 months ago

I’m confused about option A. Just because it doesn’t reveal health or race doesn’t mean it’s non-sensitive, right? I feel like it could still be personal data.

Cordelia 3 months ago

This reminds me of a practice question where we classified data types. I think option B makes sense since it’s used for authentication, but I’m hesitant about the implications of user profiling.

Francesco 3 months ago

I remember discussing how biometric data can be sensitive, so I’m leaning towards option D, but I’m not entirely sure if typing patterns count as special category data.

IAPP AIGP Exam - Topic 1 Question 50 Discussion