PDF CIPP-C Study Guide

The role of Canadian courts in reviewing decisions made by provincial oversight authorities generally involves examining whether there have been specific types of errors in the decision-making process, such as a misinterpretation of a term in the legislation or application of the law. This judicial review focuses on the legality and reasonableness of the decisions, ensuring that oversight authorities correctly interpret and apply the legislative framework governing privacy and data protection. This review does not extend to re-evaluating all investigative notes or comparing decisions across different provincial authorities, as such tasks are beyond the scope of a typical judicial review process. Therefore, Option C correctly describes the court's role.

Oversight authorities generally allow various forms of consent including implied consent, verbal consent, and written consent specific to the purpose for which the information is collected. However, they do not typically accept a "general consent" that covers all activities associated with the personal information. Consent must be specific and informed, clearly relating to the particular context in which personal information is to be used or disclosed. General consent fails to meet the specificity required under privacy laws like PIPEDA, which necessitates that consent be explicit for particularly sensitive information or whenever there is a significant change in the use of the information.

Before implementing an electronic service (e-service), a federal government department is required to complete a Privacy Impact Assessment (PIA) in accordance with Treasury Board guidelines. A PIA is a process that helps federal institutions to evaluate how new or substantially modified programs or services could affect individual privacy and to address those effects appropriately. The guidelines provided by the Treasury Board specify how PIAs should be conducted to ensure that all privacy risks are identified and mitigated before the implementation of a new or modified e-service. This requirement is crucial for maintaining the privacy and security of personal information handled by government departments.

The key difference between the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Personal Information Privacy Act (PIPA) of both Alberta and British Columbia is the scope of their application. PIPEDA applies to federal undertakings and to organizations that engage in commercial activities across provincial or national borders, thus under federal jurisdiction. In contrast, PIPA legislation in Alberta and British Columbia applies only to private organizations within those provinces, covering most commercial activities that do not cross provincial boundaries unless otherwise covered under federal law. This distinction highlights the division of legislative powers between federal and provincial levels concerning privacy regulation in Canada.