CIPP/C: Certified Information Privacy Professional/CanadaDemo

By IAPP · Question Mode

QuestionQ12

Canadian Privacy Laws and Practices in the Public Sector

According to the federal Privacy Commissioner, which protection is absent from the Privacy Act when government work involving personal information is outsourced?

  • A A statement preventing the vendor to whom the information is outsourced to subcontract its processing.
  • B A statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.
  • C A statement requiring the government agency to complete a Privacy Impact Assessment (PIA) prior to outsourcing to a third party.
  • D A statement indicating that the government institution from which the information is outsourced remains accountable for its security.
Explanation

The Privacy Act lacks an explicit provision confirming that, when departmental work is outsourced, the originating government institution remains accountable for the personal information and it remains under that institution’s control. The Office of the Privacy Commissioner of Canada recommended adding this protection.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!