Chapter 3

Question 1

Explain the privacy act

Answer 1

-Governs the handling practises of personal information by federal government department and agencies
-Imposes obligations on federal government departments and agencies to respect the privacy rights of Canadians
-Places a limit on the collection, use, and disclosure of personal information
-Provides an individuals right to access and correct personal information the government of Canada holds about them

Question 2

Explain digital privacy act

Answer 2

-strengthens privacy rights and protections for Canadians in their dealings with private sector companies
-Improves accountability, and provides incentives for organizations to comply with the law
-amends PIPEDA, including the introduction of mandatory breach notification in the event of a privacy breach that may result in a “real risk of significant harm” to an individual

Question 3

Explain personal information protection and electronic documents act (PIPEDA)

Answer 3

-governs the collection, use, retention, and disclosure of personal information
-Places limitations on how long personal information can be retained, but doesn’t prescribe any specific timelines for such retention

Question 4

Explain Canada‘s anti-spam legislation (CASL)

Answer 4

-the federal law dealing with spam and other electronic threats
-Applies to all commercial electronic messages that businesses send in relation to a commercial activity and requires that business sending these messages within, from, or to Canada have consent from recipients before sending messages

Question 5

Explain the office of the superintendent of financial institutions (OSFI)

Answer 5

-Regulates and monitors federally charted and foreign insurance companies
-Ensures the financial integrity of all insurers, including measures to safeguard insurance company solvency

Question 6

Explain technology and cyber security incident reporting (Advisory)

Answer 6

-Issued by OSFI in 2019
-Sets out expectations for federally regulated financial institutions to address technology and cyber security incident
-States that technology or cyber security incidents assessed to high or critical severity level should be reported to OSFI and states some characteristics to define these types of incidents
-Threshold for reporting incidents under the advisory is potentially broader than the threshold for reporting privacy breaches under PIPEDA
-Must notify OSFI within 24 hours of determining that a reportable incident has occurred

Question 7

Explain the European Union general data processing regulation (GDPR)

Answer 7

-Regulates the processing by an individual company or an organization of personal data relating to individuals in the EU
-Applies to all companies handling the personal data of EU residence, including companies established outside the EU that offers goods or services to EU residence or monitor their behaviour

Question 8

What are the penalties for noncompliance under the GDPR?

Answer 8

-Fines up to 2% of a companies global turnover or €10 million (whichever is higher)
-Fines up to 4% of a companies global turnover or €20 million (whichever is higher)

Question 9

Under the GDPR explain the definition of consent

Answer 9

The consent must be:
Specific
Informed
Unambiguous and
Freely given by statement or clear, affirming actions

Question 10

Under the EU, what is the time frame an attack must be report within?

Answer 10

72 hours

Question 11

Under the OSFI, what is the time frame an attack must be report within?

Answer 11

24 hours