Private Sector Flashcards by Eworitse Emiko

What is PIPDEA

Federal privacy law that governs the collection, use, and disclosure of personal information by private sector for commercial purpose

How well did you know this?

Not at all

Perfectly

What are the situations where the PIPDEA does not apply

Government institutions
Personal or domestic purpose
Journalist, artistic or literary purpose

How well did you know this?

Not at all

Perfectly

PIPEDA does not apply to Quebec, Alberta, and BC unless when ?

It is a federal work (banks, telecom)
The personal information crosses provincial borders in the course of commercial activity

How well did you know this?

Not at all

Perfectly

When a province has a legislation that matches PIPEDA, what does it have to do?

Communicate with the industry Canada (innovation, science, and economic development Canada). They may consult with OPC to access the alignment between PIPEDA and provincial law

How well did you know this?

Not at all

Perfectly

PIPEDA does not apply to what type of info?

Does not apply to information that is publicly available and can be found is publications.

Information for the purpose of communication with the individual in relation to their employment, business, or profession

Certain organizations, such as investigative bodies and organizations in regulated professions

Collection of personal information for the purpose of establishing, managing, or terminating an employment,

Collection of personal information if it is part of business transaction.

How well did you know this?

Not at all

Perfectly

What are the privacy principles under PIPEDA

Accountability,
Consent
Identifying purpose
Limiting collection of information
Limting use, disclosure and retention
Accuracy
Safeguard
Openness
Individual access
Challenging compliance

How well did you know this?

Not at all

Perfectly

What are the legal grounds in Alberta’s Personal Information Protection Act (PIPA) for use, disposal and retention of personal data

Vital interest, legal obligation, and performance of labor contract as consent

How well did you know this?

Not at all

Perfectly

What type of consent is required in BC’s PIPA ?

Explicit or implied before data collection

How well did you know this?

Not at all

Perfectly

Does BC’s PIPA differ to PIPEDA where federal jurisdictions prevail

Yes

How well did you know this?

Not at all

Perfectly

Can organizations outsource their privacy obligations

How well did you know this?

Not at all

Perfectly

Does BC’s PIPA presides over conflicting provincial law

Yes

How well did you know this?

Not at all

Perfectly

What province’s health privacy laws are similar to PIPEDA

Ontario
New foundland and Labrador
New Brunswick
Nova Scotia

How well did you know this?

Not at all

Perfectly

What does PIPEDA Accountability principle mean

Ensuring there is a designated position handling matters
Responsible for 3rd party processing
Implementation of policies and practices

How well did you know this?

Not at all

Perfectly

What is PIPEDA’s identifying purpose

The identifying purpose for which the information is collected must be identified by the organization at/before the time to data collection

Purposes must be documented, identified at collection, new purpose identified, and explanation of collection purpose.

How well did you know this?

Not at all

Perfectly

What are the principles of PIPEDA Consent

Freely given
Consent at the time of collection
Informed and knowledgeable
Withdrawal

How well did you know this?

Not at all

Perfectly

Under PIPEDA, when can personal information be collected, used, or disclosed without the knowledge and consent of the individual

Emergencies
Detection and prevention of fraud or law enforcement
Minor or mentally incapacitated

How well did you know this?

Not at all

Perfectly

What is the fine amount for PIPEDA

10k for summary conviction or 100k for indictable offenses

How well did you know this?

Not at all

Perfectly

Risk associated with non compliance

Complaints and investigation
Public disclosure
Legal remedies
Financial loss
Risk of class action lawsuits

How well did you know this?

Not at all

Perfectly

What are the three types of breach notification

Notification to OPC, individual and other organizations

What provinces health legislation is similar to PIPEDA

New Brunswick
Ontario
Newfoundland and Labrador
Nova Scotia

What provinces refer to entities managing personal health info as Custodians

Alberta
Nova Scotia
Newfoundland and Labrador
New Brunswick

What provinces refer to entities managing personal health info as trustee

Manitoba
Saskatchewan

Ontario PHIPA applies to what

Gathering of personal health data by custodians
Usage and sharing of data
Handling of a health number by any custodians

Is Timeframe of when the info is received relevant under ON PHIPA

Timeframe of when the information was received is irrelevant under ON PHIPA

Does PHIPA and its regulation take precedence over other legislative acts and regulations

Yes

What is the information Commissioner of Canada responsible for ?

Overseeing compliance with the Access to Information Act ensure transaperacy and accountability within the federal government by investigating complaints from individuals who have been denied access to government records or information

The privacy commissioner is responsible for administering what Acts?

PIPDEA and Privacy Act

is the privacy commissioner an administrative tribunal ?

no, it is an agent of Parliament embodying independence and accountability

Who is governed by the Privacy Act

Federal government entities handling the collection, use, and sharing of personal information of individuals

what organizations are excluded from the privacy Act

political parties, private organizations, and court

what type of personal information are excluded as personal information in the privacy act

20 years old information on deceased individuals, ministerial advisers, government employee, contractors, and discretionary financial benefits

What are the parameters for consent under the Privacy Act

original purpose of collection, consistent use, and nonconsensual disclosure

Under the Privacy Act, what is the process for requesting access to personal information

A request has to be made in writing and attended to within 30 days

What are the 13 exemptions key areas to access information under the a Privacy Act.

solicitor-client privilege; national security and law enforcement; federal-provincial harm; less than 20 years of info related to law enforcement; 3rd party or individual harm

In what scenarios can govt disclose personal info

original purpose; internal audits; lib archives; court subpoena/warrents; act of parliament purpose/investigative body; parliament; statistical purpose if the head of govt approves; aboriginal govt; debt owing to the crown

What is the CASL

An act to promote the efficiency and adaptability of the Canadian economy by and revolves around a range of electronic communication

Who is binded by the CASL

Corporations operating as an agent of the Her Majesty for commercial activities and non-profit organizations and registered charities.

What is the territorial scope of the CASL

It is inclusive of any CEM that is either dispatched from or received by the a system in Canada

What is a commercial electronic message according to the CASL

Any electronic message with content that encourages participation in a commercial activity. This includes offer to sell, advertise and promote business, persons or images

What are the exceptions to CEM

Electronic messages sent for the purpose of law enforcement, public safety, international affairs/defense of Canada, and protection of Canada.

What are the content requirement of a message under CASL

1) Contact information of the sender or entity on whose behalf the message was sent. It has to be valid for a minimum of 60 days 2) conform to prescribed requirement under the legislation. 3) identification of the sender and the entity on whose behalf it was sent. 4) unsubscribe link valid for at least 60 days . request to unsubscribe must be acted on within 10 days and the unsubscribe process must be straightforward

The CASL rules does not apply to

personal/ family business information specific classes or circumstances

who is responsible for enforcing the CASL

Competition Breau, Office of Privacy Commissioner, the Canadian radio-television and Telecommunication Commission (CRTC)

What are the penalties to non-compliance under the CASL

1 Million for individual and up to 10Million for businesses

Under the Privacy Act what is considered personal information

identifying number, race name address, biometric O

What province have similar privacy laws to PIPEDA

Bc, Alberta, Quebec