I85PREP
⌘ K
CIPP/C study materials
CIPP/C study resources

CIPP/C practice questions

One question at a time. Build your CIPP/C understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Canadian Privacy Law and Policy

Under PIPEDA, which organization is responsible for overseeing compliance with the Act for private-sector organizations subject to federal jurisdiction?

  1. The Competition Bureau of Canada
  2. The Canadian Radio-television and Telecommunications Commission
  3. The Office of the Privacy Commissioner of Canada Correct answer.
  4. The Office of the Information Commissioner of Canada

Explanation

PIPEDA is administered and enforced by the Privacy Commissioner of Canada, who investigates complaints, audits and can take matters to Federal Court. The Information Commissioner handles access to information, not privacy, so the two offices must not be confused.

Question 2Canadian Privacy Law and Policy

Which federal statute governs how private-sector organizations may collect, use and disclose personal information in the course of commercial activity?

  1. The Personal Information Protection and Electronic Documents Act Correct answer.
  2. The Privacy Act
  3. The Statistics Act
  4. The Access to Information Act

Explanation

PIPEDA sets the ground rules for private-sector handling of personal information in commercial activity, including the ten fair information principles in its Schedule 1. The Privacy Act covers federal government institutions rather than commercial organizations.

Question 3Canadian Privacy Law and Policy

Which of the following best describes the role of the Privacy Commissioner of Canada under PIPEDA?

  1. Prosecuting offenders in criminal court on behalf of complainants
  2. Investigating complaints and promoting compliance through persuasion, audits and referrals to court Correct answer.
  3. Issuing binding orders and administrative penalties for every breach
  4. Setting industry-specific privacy codes that automatically replace the Act

Explanation

The Commissioner is an ombudsman-style regulator who investigates complaints, conducts audits, and may seek enforcement in Federal Court, but does not issue binding orders under PIPEDA. The emphasis is on resolving issues and encouraging compliance rather than penalizing every breach.

Question 4Canadian Privacy Law and Policy

PIPEDA's Schedule 1 principle requiring organizations to identify the purposes for collecting personal information is known as which principle?

  1. Accountability
  2. Identifying Purposes Correct answer.
  3. Limiting Collection
  4. Consent

Explanation

The Identifying Purposes principle requires an organization to document and communicate why it collects personal information before or at the time of collection. This supports meaningful consent because individuals must understand the purposes to which they are agreeing.

Question 5Canadian Privacy Law and Policy

Which of the following is a key difference between PIPEDA and Quebec's private-sector privacy law?

  1. Quebec law does not require consent for collecting personal information
  2. PIPEDA applies only to government institutions in Quebec
  3. Quebec law applies to provincially regulated private enterprises in Quebec and includes a breach notification duty with specific thresholds Correct answer.
  4. Quebec law prohibits all cross-border transfers of personal information

Explanation

Quebec's Act respecting the protection of personal information in the private sector applies to provincially regulated enterprises in Quebec and imposes its own breach notification and privacy officer requirements. PIPEDA applies to federally regulated activities and to provinces without substantially similar legislation, so the two regimes coexist.

Question 6Canadian Privacy Law and Policy

A federally regulated bank wants to outsource customer data processing to a vendor located outside Canada. Under PIPEDA, what is the bank's primary obligation?

  1. It must use contractual or other means to ensure the vendor provides a comparable level of protection Correct answer.
  2. It must store a duplicate copy of all data within Canada
  3. It must obtain the Privacy Commissioner's prior written approval for the transfer
  4. It must notify each customer individually before every transfer

Explanation

PIPEDA remains accountable for personal information transferred to a third party, including a foreign processor, and must use contractual or other means to ensure comparable protection. The organization must also be transparent about the possibility that foreign law may apply to the data.

Question 7Canadian Privacy Law and Policy

Under PIPEDA, when is an organization generally permitted to collect personal information without the individual's knowledge or consent?

  1. When collection is clearly in the individual's interest and consent cannot be obtained in a timely way Correct answer.
  2. When the organization wants to reduce administrative costs
  3. When the individual is a customer of a competitor
  4. When the information would be useful for a future marketing campaign

Explanation

PIPEDA allows collection without knowledge or consent in narrow circumstances, including where it is clearly in the individual's interest and consent cannot be obtained in a timely way. Other exceptions include legal, security and emergency situations, not convenience or marketing purposes.

Question 8Canadian Privacy Law and Policy

An organization subject to PIPEDA receives a request from an individual to access their personal information. Which statement best reflects the Act's requirement?

  1. The organization may refuse all access requests without giving reasons
  2. The organization must provide access only if the individual pays a court fee
  3. The organization has up to one year to respond
  4. The organization must respond within 30 days, subject to limited extensions and specific exceptions Correct answer.

Explanation

PIPEDA requires an organization to respond to an access request within 30 days, with limited permitted extensions, and to provide access unless a specific exception applies. Where access is refused, the organization must inform the individual of the reasons and available recourse.

Question 9Canadian Privacy Law and Policy

Which principle of PIPEDA requires that personal information be as accurate, complete and up to date as is necessary for the purposes for which it is used?

  1. Individual Access
  2. Openness
  3. Safeguards
  4. Accuracy Correct answer.

Explanation

The Accuracy principle requires information to be sufficiently accurate and current for its intended use, minimizing the risk of decisions based on outdated data. Safeguards concerns security, Openness concerns transparency about policies, and Individual Access concerns the right to review one's data.

Question 10Canadian Privacy Law and Policy

Which of the following best describes the 'Challenging Compliance' principle under PIPEDA?

  1. Individuals must challenge the Commissioner's findings before contacting the organization
  2. Organizations must provide a mechanism for individuals to challenge compliance with the principles Correct answer.
  3. Organizations must challenge every complaint in court
  4. Organizations must challenge the accuracy of all data before using it

Explanation

Challenging Compliance requires organizations to give individuals a way to challenge compliance with the fair information principles and to investigate and respond to those challenges. It is about accessible recourse within the organization, not litigation.

Question 11Canadian Privacy Law and Policy

Under PIPEDA, which of the following is a valid basis for an organization to disclose personal information without consent?

  1. Disclosure to a potential investor for due diligence
  2. Disclosure to a marketing partner for a new product launch
  3. Disclosure to a debt collector for any unpaid invoice
  4. Disclosure required by law, such as a court order Correct answer.

Explanation

PIPEDA permits disclosure without consent where required by law, including a subpoena or court order, and in other narrow circumstances such as emergencies or lawful investigations. Commercial or marketing disclosures generally require consent.

Question 12Canadian Privacy Law and Policy

Which of the following best describes the 'Safeguards' principle under PIPEDA?

  1. Organizations must protect personal information with security measures appropriate to its sensitivity Correct answer.
  2. Organizations must encrypt all communications regardless of context
  3. Organizations must appoint a government-approved security auditor
  4. Organizations must destroy all personal information after one year

Explanation

The Safeguards principle requires security measures proportionate to the sensitivity of the information, its amount, distribution and format, and the nature of the storage. It is a flexible, risk-based standard rather than a fixed rule about encryption or retention.

Question 13Canadian Privacy Law and Policy

An organization subject to PIPEDA wants to use personal information for a new purpose not identified at collection. What must it generally do?

  1. Notify the Commissioner only after the use begins
  2. Obtain consent for the new purpose before using the information Correct answer.
  3. Rely on the original consent for all future uses
  4. Proceed if the new purpose is profitable

Explanation

Personal information may only be used for purposes identified at collection; a new purpose generally requires fresh consent before use. This reflects the purpose-limitation and consent principles working together.

Question 14Canadian Privacy Law and Policy

Which of the following is true about the Privacy Act (Canada)?

  1. It governs personal information held by federal government institutions Correct answer.
  2. It applies to private-sector businesses engaged in commercial activity
  3. It applies only to provincial governments
  4. It is administered by the Commissioner of Competition

Explanation

The federal Privacy Act governs how federal government institutions collect, use, disclose, retain and dispose of personal information. It is separate from PIPEDA, which addresses private-sector commercial activity.

Question 15Canadian Privacy Law and Policy

A provincial health information law may be treated as substantially similar to PIPEDA. What is the practical effect of such a determination?

  1. The Privacy Commissioner loses all jurisdiction over health data
  2. Organizations may choose either law at random
  3. The provincial law is suspended
  4. PIPEDA ceases to apply to the health information covered by the provincial law Correct answer.

Explanation

Where a province enacts legislation deemed substantially similar, PIPEDA generally does not apply to personal information covered by that provincial law, allowing the provincial regulator to take the lead. The determination is made through the federal process and does not suspend the provincial law.

Question 16Canadian Privacy Law and Policy

Which of the following best describes the 'Accountability' principle under PIPEDA?

  1. Organizations must publish the names of all employees who access personal information
  2. Organizations must obtain consent for all uses, including those permitted by law
  3. Organizations must report every privacy incident to the Commissioner within 24 hours
  4. Organizations must designate an individual responsible for compliance and implement policies and procedures Correct answer.

Explanation

Accountability requires an organization to designate one or more individuals responsible for compliance and to implement policies and practices, including complaint handling and staff training. It does not require publishing employee names or reporting every incident within 24 hours.

Question 17Canadian Privacy Law and Policy

Which of the following best describes the 'Limiting Use, Disclosure and Retention' principle under PIPEDA?

  1. Organizations must disclose information to any third party on request
  2. Personal information must not be used or disclosed for purposes other than those identified, except with consent or as required by law, and must be retained only as long as necessary Correct answer.
  3. Organizations may use information for any purpose once collected
  4. Organizations must retain all information for at least seven years

Explanation

This principle restricts use and disclosure to the identified purposes unless consent or law permits otherwise, and requires retention only as long as necessary for those purposes. It also requires destruction or anonymization when retention is no longer required.

Question 18Canadian Privacy Law and Policy

An organization subject to PIPEDA experiences a breach of security safeguards involving personal information. Under the breach of security safeguards provisions, what must the organization do?

  1. Report every breach to the Commissioner regardless of risk
  2. Report breaches to the Commissioner and notify affected individuals where there is a real risk of significant harm Correct answer.
  3. Notify only its insurer
  4. Post a notice on its website within one year

Explanation

PIPEDA requires reporting to the Privacy Commissioner and notification to affected individuals when a breach creates a real risk of significant harm, based on sensitivity and the probability of misuse. Organizations must also keep records of all breaches for a prescribed period.

Question 19Canadian Privacy Law and Policy

Which of the following best describes the 'Openness' principle under PIPEDA?

  1. Organizations must make their privacy policies and practices readily available to individuals Correct answer.
  2. Organizations must publish their financial statements
  3. Organizations must hold open meetings with customers
  4. Organizations must disclose all personal information they hold to the public

Explanation

Openness requires an organization to make information about its privacy policies and practices readily available, including what information it holds and how it is used. This supports informed consent and individual access.

Question 20Canadian Privacy Law and Policy

Which of the following is a purpose of Canada's Anti-Spam Legislation (CASL) that intersects with privacy compliance?

  1. Regulating the sending of commercial electronic messages and requiring consent Correct answer.
  2. Regulating competition between banks
  3. Governing access to government records
  4. Setting maximum prices for telecommunications services

Explanation

CASL regulates commercial electronic messages, requiring consent and identification information, and works alongside PIPEDA where such messages involve personal information. It addresses spam and related online threats rather than pricing or access to records.

Question 21Canadian Privacy Law and Policy

An organization receives a complaint from an individual alleging a PIPEDA violation. Which sequence best reflects the typical complaint process?

  1. The individual must sue in court first, then complain to the Commissioner
  2. The Commissioner automatically fines the organization without investigation
  3. The individual complains to the organization and may then complain to the Privacy Commissioner, who may investigate and attempt to resolve the matter Correct answer.
  4. The complaint is sent directly to the Federal Court of Appeal

Explanation

Individuals are generally encouraged to raise concerns with the organization first, and may then bring a complaint to the Privacy Commissioner, who investigates and seeks resolution. The Commissioner may refer unresolved matters to the Federal Court for a hearing.

Question 22Canadian Privacy Law and Policy

Which of the following best describes how the 'Consent' principle under PIPEDA treats the form of consent?

  1. Consent may be assumed for all commercial activities
  2. Consent may be express or implied, and its form depends on the sensitivity of the information and reasonable expectations Correct answer.
  3. Consent is never required for sensitive information
  4. Consent must always be written and signed

Explanation

PIPEDA allows express or implied consent, with the appropriate form depending on the sensitivity of the information and the reasonable expectations of the individual. Sensitive information generally calls for express consent, while less sensitive information may permit implied consent.

Question 23Canadian Privacy Law and Policy

Which of the following best describes the 'Individual Access' principle under PIPEDA?

  1. Organizations may deny access without reasons
  2. Individuals have the right to access their personal information and to challenge its accuracy and completeness Correct answer.
  3. Individuals have the right to access other people's personal information on request
  4. Individuals must pay a government fee to access their information

Explanation

Individual Access gives individuals the right, on request, to be informed of the existence, use and disclosure of their personal information and to access it, and to challenge accuracy. Organizations must respond within the statutory timeframe and justify any refusal.

Question 24Canadian Privacy Law and Policy

A company subject to PIPEDA plans to use personal information for a purpose that a reasonable person would consider appropriate in the circumstances. Which principle is most directly engaged?

  1. The obligation to publish data in open formats
  2. The prohibition on all secondary uses
  3. The requirement to obtain ministerial approval
  4. The reasonable-person test for appropriate purposes in collection, use and disclosure Correct answer.

Explanation

PIPEDA includes a reasonableness standard: organizations may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. This operates alongside consent and purpose limitation rather than replacing them.

Question 25Canadian Privacy Law and Policy

Which statement best captures the relationship between PIPEDA and provincial private-sector privacy laws that are not deemed substantially similar?

  1. The provincial law always prevails over PIPEDA
  2. PIPEDA never applies in a province with any privacy law
  3. The two laws cannot coexist in the same province
  4. PIPEDA applies to the extent of federal jurisdiction, while the provincial law applies to provincially regulated matters within that province Correct answer.

Explanation

PIPEDA applies to personal information in commercial activity within federal jurisdiction, including interprovincial and international activity, while provincially regulated organizations are governed by their provincial law unless it is not substantially similar. The regimes can coexist with different scopes.

Question 26Canadian Privacy Law and Policy

Which federal statute governs the collection, use and disclosure of personal information by private-sector organizations in Canada?

  1. The Privacy Act
  2. The Statistics Act
  3. The Personal Information Protection and Electronic Documents Act Correct answer.
  4. The Access to Information Act

Explanation

PIPEDA is the federal private-sector privacy statute, applying to organizations that collect, use or disclose personal information in the course of commercial activity. The Privacy Act covers federal government institutions, and the Access to Information Act concerns access to government records.

Question 27Canadian Privacy Law and Policy

Under PIPEDA, what does the term 'personal information' mean?

  1. Information about an identifiable individual Correct answer.
  2. Any data stored in an electronic database
  3. Only information collected with express consent
  4. Business contact details of employees

Explanation

PIPEDA defines personal information as information about an identifiable individual, regardless of format. It is not limited to electronic records, nor to information collected with a particular form of consent.

Question 28Canadian Privacy Law and Policy

Which organization is responsible for overseeing compliance with PIPEDA at the federal level?

  1. The Office of the Privacy Commissioner of Canada Correct answer.
  2. The Office of the Information Commissioner of Canada
  3. The Canadian Radio-television and Telecommunications Commission
  4. The Canadian Human Rights Commission

Explanation

The Privacy Commissioner of Canada investigates complaints, audits and provides guidance under PIPEDA. The CRTC enforces CASL, the Information Commissioner handles access to information, and the Human Rights Commission deals with discrimination.

Question 29Canadian Privacy Law and Policy

Under PIPEDA, which principle requires an organization to designate an individual accountable for its privacy practices?

  1. Accuracy
  2. Openness
  3. Consent
  4. Accountability Correct answer.

Explanation

The Accountability principle requires an organization to designate one or more individuals responsible for compliance and to implement policies and procedures. Consent, accuracy and openness are distinct principles addressing other obligations.

Question 30Canadian Privacy Law and Policy

Under PIPEDA, an organization must generally obtain consent for the collection, use or disclosure of personal information. Which statement best describes the role of the reasonable-person test?

  1. It sets a fixed retention period
  2. It applies only to government institutions
  3. It helps determine whether a purpose is appropriate in the circumstances Correct answer.
  4. It replaces the need to obtain any consent

Explanation

PIPEDA uses the reasonable-person test to assess whether a purpose for collecting, using or disclosing personal information is appropriate. It does not eliminate consent, apply only to government, or fix retention periods.

Question 31Canadian Privacy Law and Policy

A retailer wants to collect a customer's email address at checkout. Which form of consent is generally acceptable under PIPEDA for this routine, low-sensitivity collection?

  1. No consent is required for email addresses
  2. Implied consent through the customer's voluntary provision of the address Correct answer.
  3. Consent from the customer's employer
  4. Written consent signed by the customer

Explanation

PIPEDA allows implied consent where the context makes the individual's consent clear, and providing an email address at checkout for an obvious purpose can support implied consent. Express written consent is not mandatory for every collection, and email addresses remain personal information.

Question 32Canadian Privacy Law and Policy

Under PIPEDA, which of the following is an exception allowing an organization to collect personal information without the individual's knowledge or consent?

  1. When the individual is a customer of the organization
  2. When the information will be used for marketing
  3. When the organization is a federally regulated bank
  4. When collection is clearly in the individual's interest and consent cannot be obtained in a timely way Correct answer.

Explanation

PIPEDA permits collection without knowledge or consent in limited circumstances, including where collection is clearly in the individual's interest and consent cannot be obtained in a timely way. Marketing, ordinary customer relationships and the organization's regulated status do not create exceptions.

Question 33Canadian Privacy Law and Policy

A company subject to PIPEDA plans to disclose personal information to a third party for processing. What does PIPEDA require regarding accountability in this transfer?

  1. The third party becomes solely responsible without any contract
  2. The organization remains accountable for the information and must use contractual means to protect it Correct answer.
  3. The organization must obtain approval from the Privacy Commissioner
  4. The organization is relieved of responsibility once the data is transferred

Explanation

Under PIPEDA, an organization transferring personal information to a third party for processing remains accountable and must use contractual or other means to provide comparable protection. Responsibility does not shift entirely to the third party, and Commissioner approval is not required.

Question 34Canadian Privacy Law and Policy

Under PIPEDA, when an individual requests access to their personal information, which obligation applies to the organization?

  1. It must transfer the request to the Privacy Commissioner
  2. It must respond within the statutory time limit and generally provide access Correct answer.
  3. It must always charge a fee equal to its costs
  4. It may refuse all requests without explanation

Explanation

PIPEDA requires organizations to respond to access requests within the prescribed time and generally provide access to the information, subject to limited exceptions. Refusals must be justified, fees may be minimal, and requests are handled by the organization rather than transferred to the Commissioner.

Question 35Canadian Privacy Law and Policy

Under PIPEDA, which principle limits the amount of personal information collected to what is necessary for the identified purpose?

  1. Safeguards
  2. Consent
  3. Individual Access
  4. Limiting Collection Correct answer.

Explanation

The Limiting Collection principle requires that collection be limited to what is necessary for the identified purposes and be collected by fair and lawful means. Consent, safeguards and individual access address different obligations.

Question 36Canadian Privacy Law and Policy

An organization subject to PIPEDA wants to retain customer records indefinitely for possible future use. Which principle is most directly engaged?

  1. Challenging Compliance
  2. Openness
  3. Limiting Use, Disclosure and Retention Correct answer.
  4. Accuracy

Explanation

The Limiting Use, Disclosure and Retention principle requires that personal information not be kept longer than necessary for the identified purpose. Indefinite retention for speculative future use conflicts with this principle.

Question 37Canadian Privacy Law and Policy

Under PIPEDA, which principle requires organizations to protect personal information with security measures appropriate to its sensitivity?

  1. Openness
  2. Consent
  3. Accountability
  4. Safeguards Correct answer.

Explanation

The Safeguards principle requires security measures proportionate to the sensitivity of the information and the nature of the risks. Consent, accountability and openness address other aspects of privacy management.

Question 38Canadian Privacy Law and Policy

Under PIPEDA, which principle requires organizations to make their privacy policies and practices readily available to individuals?

  1. Accuracy
  2. Limiting Collection
  3. Openness Correct answer.
  4. Safeguards

Explanation

The Openness principle requires organizations to make information about their privacy policies and practices readily available. Accuracy, limiting collection and safeguards address different obligations.

Question 39Canadian Privacy Law and Policy

An individual believes an organization subject to PIPEDA has violated their privacy rights. What is the typical first step in the complaint process?

  1. Filing a statement of claim directly in Federal Court
  2. Filing a complaint with the Privacy Commissioner of Canada Correct answer.
  3. Requesting a ministerial review
  4. Reporting the matter to the CRTC

Explanation

Individuals generally file complaints with the Privacy Commissioner, who investigates and may attempt to resolve or issue findings. Court action typically follows the Commissioner's process, and the CRTC and ministers do not handle PIPEDA complaints.

Question 40Canadian Privacy Law and Policy

Under PIPEDA, what must an organization generally do when a breach of security safeguards creates a real risk of significant harm to individuals?

  1. Report the breach only to its insurer
  2. Report the breach to the Privacy Commissioner and notify affected individuals Correct answer.
  3. Wait for individuals to complain before acting
  4. Notify the police in every case

Explanation

PIPEDA's breach provisions require organizations to report breaches involving a real risk of significant harm to the Privacy Commissioner and to notify affected individuals. Notification to insurers or police is not the statutory requirement, and organizations cannot wait for complaints.

Question 41Canadian Privacy Law and Policy

Under PIPEDA, which of the following is a valid basis for disclosing personal information without consent?

  1. Disclosure to a data broker for resale
  2. Disclosure to a lawyer representing the organization in a legal proceeding Correct answer.
  3. Disclosure to a parent company for general business planning
  4. Disclosure to a marketing partner for cross-promotion

Explanation

PIPEDA permits disclosure without consent in limited circumstances, including to a lawyer representing the organization. Marketing partnerships, resale to data brokers and general business planning are not recognized exceptions and normally require consent.

Question 42Canadian Privacy Law and Policy

A provincial private-sector privacy law has been found substantially similar to PIPEDA. What is the practical effect for organizations in that province?

  1. Organizations may choose either law for any activity
  2. PIPEDA still applies to all activities in that province
  3. The provincial law applies to intra-provincial activities in place of PIPEDA Correct answer.
  4. The provincial law applies only to government institutions

Explanation

Where a province enacts substantially similar private-sector legislation, it applies to personal information collected, used or disclosed within the province, and PIPEDA generally does not apply to those intra-provincial activities. PIPEDA continues to apply to federally regulated and cross-border activities.

Question 43Canadian Privacy Law and Policy

Which statement best describes the relationship between PIPEDA and provincial private-sector privacy laws that are not substantially similar?

  1. The Privacy Commissioner decides which law applies case by case
  2. The provincial law always prevails over PIPEDA
  3. PIPEDA applies to organizations in those provinces for intra-provincial commercial activity Correct answer.
  4. Neither law applies until a complaint is filed

Explanation

If a province has not enacted substantially similar private-sector legislation, PIPEDA applies to organizations carrying on commercial activity within that province. The provincial law does not automatically prevail, and no case-by-case decision by the Commissioner is required.

Question 44Canadian Privacy Law and Policy

Under the Privacy Act (Canada), which of the following is true?

  1. It governs how federal government institutions handle personal information Correct answer.
  2. It applies to private-sector retailers
  3. It applies only to provincial governments
  4. It is administered by the CRTC

Explanation

The Privacy Act regulates the collection, use, disclosure and retention of personal information by federal government institutions. It does not apply to private-sector retailers or provincial governments, and it is overseen by the Privacy Commissioner rather than the CRTC.

Question 45Canadian Privacy Law and Policy

Which of the following best describes a purpose of Canada's Anti-Spam Legislation (CASL) that intersects with privacy compliance?

  1. Setting retention periods for personal information
  2. Regulating commercial electronic messages and requiring consent Correct answer.
  3. Creating a right of access to government records
  4. Establishing provincial health privacy rules

Explanation

CASL regulates commercial electronic messages and generally requires consent, which intersects with privacy compliance around consent and contact information. It does not set retention periods, create access rights to government records, or establish provincial health privacy rules.

Question 46Canadian Privacy Law and Policy

Under PIPEDA, which principle requires organizations to keep personal information accurate, complete and up to date as necessary for its purpose?

  1. Safeguards
  2. Openness
  3. Consent
  4. Accuracy Correct answer.

Explanation

The Accuracy principle requires personal information to be as accurate, complete and up to date as necessary for the purposes for which it is used. Consent, openness and safeguards address other obligations.

Question 47Canadian Privacy Law and Policy

Under PIPEDA, what is the general rule about identifying purposes at or before collection?

  1. The organization need not identify purposes if consent is implied
  2. The organization may identify purposes only to regulators
  3. The organization may identify purposes after collection is complete
  4. The organization must identify the purposes before or at the time of collection Correct answer.

Explanation

The Identifying Purposes principle requires organizations to identify the purposes for which personal information is collected at or before the time of collection. Purposes cannot be identified only after collection, and implied consent does not remove the need to identify purposes.

Question 48Canadian Privacy Law and Policy

A federally regulated telecommunications company collects personal information. Which law primarily governs its handling of that information?

  1. PIPEDA Correct answer.
  2. The Access to Information Act
  3. A provincial private-sector privacy law
  4. The Privacy Act

Explanation

Federally regulated organizations such as telecommunications companies are subject to PIPEDA for their handling of personal information. The Privacy Act and Access to Information Act concern government institutions, and provincial private-sector laws do not displace PIPEDA for federally regulated activities.

Question 49Canadian Privacy Law and Policy

Under PIPEDA, an organization designates a privacy officer and adopts written privacy policies. Which principle do these actions most directly satisfy?

  1. Accuracy
  2. Individual Access
  3. Accountability Correct answer.
  4. Limiting Collection

Explanation

Designating a responsible individual and adopting policies are core requirements of the Accountability principle. Limiting collection, accuracy and individual access concern other distinct obligations.

Question 50Canadian Privacy Law and Policy

A federally regulated bank wants to transfer customer account data to a payroll processing vendor located in the United States. Under PIPEDA, which statement best describes the bank's obligations regarding this cross-border transfer?

  1. The bank must obtain the Privacy Commissioner's prior authorization before any transfer of personal information outside Canada.
  2. The bank must notify each affected customer individually and obtain fresh consent for every transfer to a foreign processor.
  3. The bank may transfer the data freely because PIPEDA does not apply once personal information leaves Canada.
  4. The bank remains accountable for the personal information and must use contractual or other means to ensure the vendor provides a comparable level of protection. Correct answer.

Explanation

PIPEDA's Accountability Principle (Principle 1) provides that an organization is responsible for personal information transferred to a third party, including a processor in another jurisdiction, and must use contractual or other means to ensure a comparable level of protection while the information is being processed. The Office of the Privacy Commissioner has confirmed that transfers for processing are not treated as disclosures requiring new consent when the transfer is for the original purpose. There is no requirement for prior OPC authorization, and PIPEDA continues to apply to the Canadian organization.