Exactprep CIPP-C Questions

Under the federal Privacy Act, which governs how federal public-sector organizations manage personal information, the law specifies conditions under which personal information may be collected. These include when the collection directly relates to and is necessary for an operating program or activity of the institution (Option A), when it is for the purposes of law enforcement (Option B), or when it is expressly authorized under another act (Option C). However, the Privacy Act does not include a general provision that allows for the collection of personal information based solely on consent (Option D). The Act is designed to limit the collection of personal information to what is strictly necessary for government functions, without relying on the consent of the individual as a basis for collection. Therefore, Option D is the correct answer as it is not a requirement under the federal Privacy Act.

The case of Abika.com was significant in establishing the jurisdiction of the Office of the Privacy Commissioner of Canada (OPC) over foreign entities processing personal data of Canadians. In this case, the Federal Court ruled that the OPC had the authority to investigate complaints about a US-based company, Abika.com, which was collecting, using, and disclosing the personal information of individuals in Canada for background checks. This case helped to affirm the OPC's role in overseeing how Canadian citizens' personal information is handled by companies, regardless of their geographic location, ensuring that the privacy rights of Canadians are respected by foreign operators engaging with Canadian data subjects.

According to the Canadian Standards Association (CSA) Model Code, which forms part of the principles under PIPEDA, when errors in personal information are identified by the individual to whom the data pertains, the organization is required to amend the information as necessary to correct the inaccuracies. This obligation ensures that personal information held by an organization is accurate, complete, and up-to-date, particularly when it is used to make decisions about the individual. Therefore, the real estate firm should amend any information that the woman identifies as erroneous, as stated in option B. This approach ensures compliance with the accuracy principle of the CSA Model Code.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations are required to maintain a record of every breach of security safeguards involving personal information that they have determined poses a real risk of significant harm. These records must be maintained for at least 24 months after the date on which the determination was made. This requirement facilitates audits by the Privacy Commissioner of Canada and helps ensure accountability and compliance with the breach notification and record-keeping requirements set forth by PIPEDA. Therefore, the correct answer is C, "24 months."