Canadian Privacy Laws and Practices in the Private Sector
In 2007, four employees of TELUS Communications Corporation submitted a complaint to the Privacy Commissioner of Canada concerning the collection of which personal information?
AVoiceprint information.
BDrivers’ licenses.
CUrine samples.
DVideo images.
0
Community Discussion
No comments yet. Be the first to start the discussion!
Canadian Privacy Laws and Practices in the Public Sector
Which province requires government bodies to store and access personal information only in Canada unless additional consent is obtained or external storage is considered necessary?
ANova Scotia
BQuébec.
COntario.
DAlberta.
0
Community Discussion
No comments yet. Be the first to start the discussion!
The shift toward comprehensive privacy and data-protection laws can be attributed to three major factors: the need to remedy past injustices, the need to promote a digital economy, and the need to ensure consistency with what?
ASelf-regulatory laws.
BPan-European laws.
CPan-Asian laws.
DGlobal laws.
0
Community Discussion
No comments yet. Be the first to start the discussion!
Canadian Privacy Laws and Practices in the Private Sector
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Under Alberta’s Personal Information Protection Act, which of the following data-breach reporting notifications to the Commissioner is not automatically required once a real risk of significant harm (RROSH) has been determined?
AProviding a description of the steps the organization will take to notify the affected individual(s).
BProviding a description of the steps the organization has taken to reduce or mitigate that harm.
CProviding an estimate of the number of individuals affected by the breach.
DProviding a description of the personal information involved in the breach.
Under which of the following circumstances is a commercial business in Canada not permitted to collect personal information without the individual’s knowledge or consent?
AThe collection is for journalistic or literary purposes.
BThe collection is in the interests of the individual and the consent cannot be obtained in a timely way.
CThe collection would lead to the creation of products that would benefit the public and consent would be difficult to obtain.
DThe collection, with the knowledge of the individual, would compromise the availability and accuracy of the information and the collection is reasonable for the purposes related to investigating a federal law.
Which of the following employees would be covered by the Personal Information Protection and Electronic Documents Act (PIPEDA)?
AThe staff of an airline offering flights across Canada.
BUnderwriters for a New Brunswick insurance company.
CClerks at a Montreal credit union based out of Montreal.
DThe information technology department of the Saskatchewan Office of Residential Tenancies of Saskatchewan.
Which statement is true about health-information privacy laws in Canada?
AObligations regarding accountability for health information are transferred when control is outsourced to a third party.
BEmphasis is given to personal information protection over the maintenance of the publicly funded healthcare system.
CThere is a significant amount of variation among provinces regarding the definition of consent and how the consent requirement is addressed.
DIn provinces where there are no health information privacy statutes, a combination of the public health regulations and the private sector privacy legislation apply.
Which statement is not a Canadian Standards Association (CSA) Privacy Principle?
Choose two
APersonal information shall be protected by the same security safeguards regardless of the sensitivity of the information.
BThe purpose for which personal information is collected shall be identified by the organization at or before the time the information is collected.
CThe degree to which personal information must be kept accurate and complete is determined by whether its original purpose has been achieved.
DUpon request, an individual shall be informed of the existence, use and disclosure of their personal information and shall be given access to that information.
A federally regulated company headquartered in Ontario has customers in Ontario, Quebec, New Brunswick, Alberta, and British Columbia. Unfortunately, a third-party vendor that supplies marketing support to the company suffers a privacy breach affecting the personal information of all of the company’s customers across the provinces in which it operates.
The Privacy Officer concludes that the breach creates a real risk of significant harm to customers and must report the breach to the applicable regulators.
With which provincial privacy regulators must the company file a report?
AIt is unnecessary to file a report with any provinces because the company is federally regulated
BAll of the provinces where its customers are located
CNew Brunswick and British Columbia only
DQuébec and Alberta only
According to the federal Privacy Commissioner, which protection is absent from the Privacy Act when government work involving personal information is outsourced?
AA statement preventing the vendor to whom the information is outsourced to subcontract its processing.
BA statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.
CA statement requiring the government agency to complete a Privacy Impact Assessment (PIA) prior to outsourcing to a third party.
DA statement indicating that the government institution from which the information is outsourced remains accountable for its security.
Under which circumstance may a request to access an individual’s personal information be refused under the Privacy Act?
AThe personal information was collected by the Royal Canadian Mounted Police while performing policing services for a province or municipality.
BThe personal information was obtained in confidence from a foreign state or agency which has consented to the disclosure of the information.
CThe release of the personal information could reasonably be expected to cause injury to a protected species of wildlife.
DThe personal information is more than 20 years old and relates to the detection or suppression of money laundering.
What must a federal government department do before implementing an electronic service (e-service)?
AConduct a preliminary PIA before acquiring the service
BComplete a PIA in accordance with Treasury Board guidelines.
CPublish a privacy statement in newspapers and on the government website.
DDetermine if the Office of the Privacy Commissioner must be notified of the launch of this new e-service
Which existing framework is least effective at addressing emerging AI issues while dedicated AI legislation is being determined?
AThe Canada Consumer Product Safety Act.
BThe Motor Vehicle Safety Act.
CThe Copyright Act.
DThe Criminal Code.
What conclusion can be drawn from the Blood Tribe case about the Privacy Commissioner's access to information?
AThe commissioner cannot receive information unless it is gathered under oath.
BThe commissioner cannot ask an organization to prove that a document is privileged.
CThe commissioner can compel the production of all documents that are relevant to the investigation.
DThe commissioner can officially request proof that desired information is subject to solicitor-client privilege.
What is required under the “circle of care” concept in Canadian health-information privacy law?
AHealth information custodians or trustees be specified only by applicable law or regulation
BAn individual’s consent may be implied unless the individual has refused consent or if the purpose of the disclosure is not to provide health care.
CNotification to the individual be made in the event of a data breach of personal health information (PHI) by an organization that is based in Canada
DConsent must be expressed or implied when a custodian discloses personal health information (PHI) to another custodian for the purpose of providing health care.
Which of the following specifically distinguishes regular personal information from employee-related or work-product information?
AThe Privacy Act.
BThe Quebec Act.
CBritish Columbia’s Personal Information Protection Act (PIPA).
DPersonal Information Protection and Electronic Documents Act (PIPEDA).
Under PIPEDA, each of the following circumstances requires an organization to obtain express consent to use personal information EXCEPT?
AIf the use is outside of the reasonable expectations of an individual.
BIf the information is publicly available as defined by the regulation.
CIf the use is inconsistent with the original purpose.
DIf there is no risk of significant harm.
What must a provincial law include to be considered substantially similar to the Personal Information Protection and Electronic Documents Act (PIPEDA)?
AConsistency with at least eight of the ten privacy principles, an independent oversight body and a complaint handling mechanism.
BConsistency with the ten privacy principles, an independent oversight body and a process for accessing information.
CConsistency with the ten privacy principles, an independent oversight body and a redress mechanism.
DConsistency with the ten privacy principles, an appeal process and a redress mechanism.
Under the Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, signatories commit to all of the following EXCEPT?
AContributing to the development and application of AI standards.
BSharing information and best practices of AI governance.
CSupporting public awareness and education on AI.
DAdopting low-risk uses of AI.
The Government of Canada’s Directive on Privacy Impact Assessments applies to each of the following EXCEPT?
AThe Ministry of Health
BThe Bank of Canada.
CCrown Corporations.
DThe Cabinet.
A company intends to invest in DEI initiatives across its organization and plans to survey employees by asking for locality, age, salary, gender, ethnicity, religion, sexual orientation, physical/mental disabilities, department, and job level.
What is the best solution for protecting the personal information collected through the survey?
AUse a pseudonym to identify employees.
BChoose a survey tool located in Canada.
CEncrypt the sensitive information collected and stored.
DAdjust all survey questions so that no identifying information can be collected.
Under the Privacy Act, which of these disclosures of personal information by a government institution would require the consent of the data subject?
AWhen disclosing to a law enforcement body.
BWhen disclosing to comply with a search warrant.
CWhen disclosing to a registered charitable organization.
DWhen disclosing to a member of parliament to assist in resolving a problem.
Under PIPEDA, each of the following is considered personal information EXCEPT?
AA public official’s salary published on a government web site.
BA person’s telephone number published in a public directory.
CA photograph taken in public and published in a newspaper.
DInformation about a defendant contained in court records.
Community Discussion