Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP/C 2023 > Canadian Privacy Basics - Chapter 2 > Flashcards

Canadian Privacy Basics - Chapter 2 Flashcards

1
Q

2.1 What is private sector legislation based on?

A

10 fair information principles found in PIPEDA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

2.1 What are the 10 principles in PIPEDA?

A
  1. Accountability
  2. Identifying Purposes
  3. Consent
  4. Limiting Purposes
  5. Limiting Use, Disclosure and Retention
  6. Accuracy
  7. Safeguards
  8. Openness
  9. Individual Access
  10. Challenging Compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

2.1.1 What is Accountability

A

An organization must implement procedures that protect personal information, establish procedures to receive and respond to complaints or questions, train staff, and be transparent about all these procedures and practices.

Organizations are required to appoint individuals with primary responsibility for privacy protection and makes organizations responsible for the personal information over which they have either custody or control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

2.1.1 Provide an example of how Accountability can be interpreted?

A

Google (2010) created Google Buzz, which allowed Google Mail contacts to be added as followers. This resulted in an abusive ex husband to know the whereabouts of his ex-wife.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

2.1.2 What is the intent of the Identifying Purposes principle?

A

Organizations are obligated to identify and document the purposes for the collection of any personal information at or before the time of collection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

2.1.2 Can personal information be repurposed without consent of the individual?

A

No, this would be a privacy breach. If PI is collected for a different purpose, consent must once again be collected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

2.1.3 What is required for meaningful consent?

A

Meaningful consent is that which the individual knows and understands the purposes for the collection, use or disclosure of the personal information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

2.1.3 What is sensitive personal information?

A

Sensitive personal information is medical or financial, or information that could result in serious cases of identify theft.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

2.1.3 What does implied consent become appropriate?

A

When the personal information being collected is innocuous and the purpose of the collection straightforward.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

2.1.3 When is it ok to use an opt-in feature when asking for consent?

A

When the purpose of collection is straightforward and the information is innocuous,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

2.1.3 When is an opt-out feature required when asking for consent?

A

When the information being collected is sensitive, explicit and documented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

2.1.3 Is an individual required to supply more personal information than what is required?

A

No, the principle specifically states: an organization shall not… require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfill the explicitly specified and legitimate purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

2.1.3 Is consent always required?

A

Yes, each individual must be given the opportunity to withdraw consent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

2.1.4 What does the Limiting Purposes principle state?

A

Organizations are required to collect only the amount and type of personal information legitimately needed to fulfill the identified purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

2.1.5 What does the Limiting Use, Disclosure and Retention principle require?

A

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.

Personal information shall be retained only as long as necessary for the fulfillment of those purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

2.1.5 What is important to remember about retaining personal information?

A
  1. Personal information that has been used to make a decision about an individual should be retained long enough to allow the individual access to the information after the decision has been made
  2. An organization may be subject to legislative requirements with respect to retention periods for certain types of information.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

2.1.6 Why is it important to keep personal information updated while in use?

A

Organizations should make sure the information they are using to make decisions about providing credit or medical care to people is accurate in order to avoid inappropriate decisions or ill-fated consequences.

Note: the irony is that PIPEDA does not require PI to be kept up to date by law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

2.1.7 What are the requirements when safeguards are used?

A

Security safeguards must protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of media type.

Information must be protected according to the sensitivity of the information (e.g. data classification).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

2.1.8 What are the requirements of the Openness principle?

A

Policies and practices must be readily available for individuals relating to management of personal information.

Policies and practices must include:
1. Name, title and address of where complaints can be filed
2. How to gain access to PI that is held by the organization
3. A description of the type of information held by the organization, and a general statement on how it’s used
4. A copy of any information that explains the organizations policies, standards or codes.
5. The PI that is made available to related organizations, such as subsidieries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

2.1.9 What are the obligations under Individual Access?

A

Individuals must be informed of the existence, collection, use and disclosure of personal information.

Discrepancies in PI must be corrected.

Requests for access must be not be delayed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

2.1.10 Do individuals have the right to challenge how their personal information is being handled?

A

Yes, Canadian law provides individuals with the right to complain if they are unhappy with how their PI is being handled, and if the situation is not remediated by the organization.

22
Q

2.2.1 When did PIPEDA start to come into force?

A

January 1, 2001

23
Q

2.2.1 What government strategy was PIPEDA part of?

A

Canada’s electronic commerce strategy.

24
Q

2.2.1 What was the intent of Canada’s electronic commerce strategy?

A

To make Canada a world leader in electronic commerce.

25
Q

2.2.1 What was the significance of the launch of PIPEDA?

A

It ushered in a new era of privacy protection in Canada.

26
Q

2.2.1 What is the purpose of PIPEDA?

A

To establish… rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

27
Q

2.2.1 How has the purpose of PIPEDA been interpreted?

A

As a balance between the needs of protecting personal information and the needs of the organization to conduct business.

28
Q

2.2.1 What are the two competing interests that PIPEDA tries to address?

A
  1. An individual’s right to privacy and,
  2. the commercial need for access to personal information
29
Q

2.2.1 Why is the Right of Privacy not absolute within PIPEDA?

A

Because the terminology used includes:
*reasonable person
*appropriate
*in the circumstances

30
Q

2.2.1.1 To whom does PIPEDA apply to?

A

The entire private sector.

31
Q

2.2.1 What existed in Canada prior to PIPEDA?

A

A industry self-regulatory approach that is still used in the US today.

32
Q

2.2.1.1 What does Section 4 of PIPEDA state in regards to whom the act applies?

A

PIPEDA applies to every organization in respect of personal information that
a) the organization collects, uses or discloses in the course of commercial activities; or
b) is about an employee of the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business

33
Q

2.2.1.1 How is PIPEDA limited in scope?

A

It does not apply to:
a) any government institution to which the Privacy Act applies

b) any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes (and not for any other purpose)

c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes (and not for any other purpose)

34
Q

2.2.1.1 What are two important concepts to understand about PIPEDA?

A
  1. It must be determined that the organization is involved in commercial activity
  2. It must be understood to what extent the organization operates as or in connection with a federal work or undertaking.
35
Q

2.2.1.1 What ‘federal works’ are considered to fall under the legislation of PIPEDA?

A
  1. airports, airlines, aircraft
  2. telecommunications
  3. radio and television broadcasting
  4. banks
  5. grain elevators
  6. nuclear facilities
  7. offshore drilling operations
36
Q

2.2.1.1 What determines if a company is a federal work, undertaking or business?

A

If the company is subject to any part of the Canada Labour Code.

37
Q

2.2.1.1 How is PIPEDA different from other federal statutes?

A

PIPEDA was drafted to apply across the country.

38
Q

2.2.1.1 If provinces pass their own privacy law, what standards must it adhere to?

A
  1. The 10 Privacy Principles of PIPEDA.
  2. Have an independent oversight body like the OPC
  3. Contain a redress mechanism for those who are aggrieved
39
Q

2.2.1.1 What provinces have similar privacy laws?

A
  1. Alberta PIPA
  2. British Columbia PIPA
  3. The Quebec Act
  4. Ontario PHIPA
  5. New Brunswick PHIPAA
  6. Newfoundland and Labrador PHIA
  7. Nova Scotia PHIA
40
Q

2.2.1.2 How does PIPEDA define commercial activity?

A

Any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.

41
Q

2.2.1.2.2 What has OPC determined in regards to nonprofit organizations in the context of PIPEDA?

A

Even though an organization may be nonprofit and membership-based, it can still engage in commercial transactions that trigger PIPEDA.

42
Q

2.2.1.3 What does PIPEDA make mandatory when an organization collects, uses and discloses personal information?

A

The collection, use and discloser must only be done with the consent of the individual of which the personal information is being collected.

43
Q

2.2.1.3 When is consent not required when collecting personal information?

A

Consent is not required when collecting personal information in the following circumstances:
a) the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;
b) it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
c) it is contained in a witness statement and the collection is necessary to assess, process or settle an insurance claim;
d) it was produced by the individual in the course of their employment, business or profession and the collection is consistent with the purposes for which the information was produced;
e) the collection is solely for journalistic, artistic or literary purposes;
f) the information is publicly available and is specified by the regulations or the collection is made for the purpose of making a disclosure

44
Q

2.2.1.3 What obligations are critical for organizations bound by PIPEDA?

A
  1. The requirement of obtaining consent and the obligation to act reasonably when doing so.
  2. The right to provide access to personal information.
45
Q

2.2.1.3 When does the right to provide access to personal information not need to be abided by an organization bound by PIPEDA?

A
  1. When the information would reveal details about a third party for national security or law enforcement reasons;
  2. when commercially sensitive information is revealed;
  3. when solicitor-client privileged information is revealed;
  4. when life or security of an individual is threatened
46
Q

2.2.1.4 What is the role of the OPC?

A
  1. Enforcement of PIPEDA
  2. Initiate a complaint if there are reasonable grounds for doing so
  3. Utilize extensive powers of investigation, including power of subpoena and compelling individuals to give evidence
  4. Enter the premise of an organization during the investigation of a complaint
  5. Develop and conduct information programs to encourage public understanding of PIPEDA
47
Q

2.2.1.4 Are OPC investigations public or private?

A

There are statutory requirements to keep investigatory details out of the public domain unless the public interest in the matter requires otherwise, or unless on of the specific enumerated reasons for the investigation allows for the disclosure of information

48
Q

2.2.1.4 Under the OPC’s mandate of education and awareness, what is required of the OPC?

A
  1. Develop and conduct information programs to encourage public understanding the PIPEDA
  2. Carry out and publish research on matters relating to the protection of personal information
  3. Encourage organizations to voluntarily adopt appropriate compliance practices and procedures
49
Q

2.2.1.4.1 What changes were made to breach notification and record keeping requirements with the 2015 passage of the Digital Privacy Act?

A
  1. Organizations will be subject to mandatory notifications to the OPC of any breach of security safeguards involving personal information. Real significant harm requires notification to individuals.
  2. Organizations will be required to keep a record of all breaches involving personal information and provide a copy to OPC upon request.
50
Q

2.2.1.4.2 How has the Digital Privacy Act changed the definition of personal information?

A

Personal information has been updated to mean information about an identifiable individual, including business contact information.

51
Q

2.2.1.4.5 When is consent considered valid?

A

Only if it is reasonable to expect that individuals to whom an organizations’ activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting.

52
Q

2.1.4.3 When is consent not required when collecting PI?

A
  1. Investigations/fraud detection and prevention: during instances of investigations / fraud detection and prevention
  2. business transactions, such as the sale of a business, a merger, or lease of company assets
  3. Witness statements in insurance claims
  4. Identifying injured, ill, deceased or communicating with next of kin: however, if the person is alive, they must be notified in writing that their PI has been shared
  5. Financial abuse: I can be disclosed without consent if the individual has been or may be the victim of abuse
  6. Employment relationships in federally regulated workplaces: consent is not required to establish, manage, or terminate an employment relationship. However, individuals must be informed in advance that their PI can be collected, used or disclosed for such purpose
  7. Personal information produced during the course of employment: consent not required, as long as it is consistent with its intended purpose

CIPP/C 2023 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions