CIPM: Certified Information Privacy ManagerDemo

By IAPP · Question Mode

QuestionQ36

Privacy Operational Lifecycle: Respond

You are the Privacy Officer (PO) at a University. The police recently contacted you because they suspect that one of your students is using a library computer to commit financial fraud. The police seek your help investigating the individual and request the student’s computer logs and usage data. What should be your first step in responding to this request?

  • A Refuse the request as the police do not have a warrant.
  • B Provide the data to police and record it for your own archives.
  • C Contact the University's legal counsel to determine if the request is lawful.
  • D Review policies, procedures and legislation to determine the University's obligation to co-operate with the police.
Explanation

Computer logs and usage data associated with a student are personal information. A police request does not automatically require refusal or disclosure: the institution must determine, under its policies, procedures, and applicable privacy legislation, whether a lawful authority or other disclosure exception applies and whether it has an obligation to cooperate. Under PIPEDA, a law-enforcement request for non-consensual disclosure must identify lawful authority and the applicable purpose.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!