CIPP/C flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

PIPEDA commercial activity trigger

PIPEDA applies to personal information collected, used, or disclosed in the course of commercial activity, including employee information of federally regulated businesses such as banks, airlines, and telecoms.

Substantially similar designation

A provincial law declared substantially similar to PIPEDA displaces the federal Act for organizations operating in that province, preserving the federal-provincial division of powers.

Quebec Law 25

Quebec's reform of its private-sector privacy law, phasing in breach notification, privacy impact assessments, confidentiality by default, and portability, with the final provisions effective September 2025.

Alberta and BC PIPA

Provincial private-sector statutes declared substantially similar to PIPEDA. Both are overseen by independent Commissioners who issue binding orders and may impose penalties.

Privacy Act scope

The federal Privacy Act governs how federal public bodies collect, use, retain, and disclose personal information. It is overseen by the Privacy Commissioner and is not substantially similar legislation.

PIPEDA Principle 3 consent

Consent must be knowledge-based and reasonable in the circumstances. Organizations must identify purposes before or at collection and obtain consent for materially different uses.

Bill C-27 status

The bill that would have replaced PIPEDA with the Consumer Privacy Protection Act and created a Personal Information and Data Protection Tribunal died on the Order Paper in January 2025.

Health information statutes

Ontario PHIPA, New Brunswick, Newfoundland and Labrador, and Nova Scotia each have health privacy laws declared substantially similar to PIPEDA for health information held by custodians.

OPC ombudsman model

The Privacy Commissioner of Canada investigates complaints and issues findings and recommendations but cannot impose fines under PIPEDA; enforcement proceeds through the Federal Court.

Federal Court application

Under PIPEDA s. 14, a complainant may apply to the Federal Court for a hearing after the Commissioner's report, and the Court may order compliance and award damages.

Public naming power

PIPEDA s. 20(5) allows the Privacy Commissioner to publicly name an organization when a matter remains unresolved after investigation, creating reputational rather than monetary consequences.

Quebec CAI penalties

Quebec's access commission can issue binding orders and administrative monetary penalties, raised under Law 25 to the greater of CAD 15 million or 4% of worldwide turnover.

Real risk of significant harm

The threshold for mandatory breach reporting under PIPEDA, assessed by sensitivity of information and probability of misuse, considering bodily harm, humiliation, financial loss, and identity theft.

Breach record retention

Organizations must maintain a record of every breach of security safeguards for 24 months after the day the breach was discovered, and provide it to the Commissioner on request.

Ontario IPC orders

Ontario's Information and Privacy Commissioner issues binding orders and may prosecute offences under PHIPA, with maximum fines of CAD 1 million for individuals and CAD 5 million for organizations.

Joint commissioner statements

Federal, provincial, and territorial privacy regulators issue joint statements on shared priorities such as generative AI and data scraping, signalling coordinated enforcement expectations.

Accountability principle

PIPEDA Principle 1 requires designating an individual accountable for compliance, making that identity known on request, and retaining accountability even when duties are delegated.

Quebec PIA requirement

Quebec requires a privacy impact assessment before any project involving new technology, cross-border transfer, or sensitive information, and the assessment must be proportionate to sensitivity.

Cross-border transfer duty

PIPEDA requires comparable protection when transferring personal information to third parties or service providers, and disclosure that information may be accessible to foreign authorities.

Quebec pre-transfer assessment

Before transferring personal information outside Quebec, an organization must assess the destination legal framework and whether the information will receive adequate protection.

NIST Privacy Framework

A voluntary framework organized around Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P functions, used to scope and measure privacy program maturity.

Program foundational documents

Core artifacts include the privacy policy, retention schedule, consent forms, breach response plan, access procedure, vendor management procedure, and training records.

Confidentiality by default

A Quebec Law 25 principle requiring that technology settings default to the highest level of privacy protection, with no personal information disclosed unless the individual activates it.

Governance separation

Effective programs separate the privacy officer's advisory function from security operations and business ownership, with the accountable executive empowered to halt non-compliant processing.

Thirty-day access deadline

Under PIPEDA an organization must respond to an access request no later than 30 days after receipt, with a possible extension by notice to the Commissioner.

Access refusal requirements

A refusal must be in writing, cite the specific statutory exemption relied on, and inform the individual of the right to complain to the Privacy Commissioner.

Breach response sequence

Contain the breach, assess real risk of significant harm, notify the Commissioner and individuals as soon as feasible, notify mitigating organizations, and record in the register.

Consent recordkeeping

Record the date, scope, purpose, and channel of each consent, keep separate consent for materially different purposes, and avoid bundled or implied consent for sensitive data.

Vendor contract clauses

Privacy contracts should address purpose limitation, safeguards, breach notification timelines, audit rights, subcontractor approval, and return or destruction of data at termination.

Data subject request workflow

A tracked workflow with identity verification proportionate to data sensitivity, defined turnaround targets, and an escalation path for refusals and complaints.

Role-based privacy training

Frontline staff train on consent and access requests, developers on PIAs and minimization, executives on breach escalation, with completion records retained as evidence.

Program metrics

Track access-request turnaround, breach volume and time-to-notify, vendor assessment completion, and consent withdrawal rates, and feed results into annual program review.