Of the key principles in the Personal Information Protection and Electronic Documents Act (PIPEDA), which principle in particular contributes to the increase in privacy policies in recent years?

Limiting Use, Disclosure, and Retention.

A federally regulated company based in Ontario has customers in Ontario, Quebec, New Brunswick, Alberta and British Columbia. Unfortunately, a third-party vendor that provides marketing support to the company experiences a privacy breach which impacts the personal information of all its customers across the provinces where it operates.The Privacy Officer determines that the breach causes a real risk of significant harm to their customers and is tasked with reporting the breach to the relevant regulators.With which provincial privacy regulators does the company have to file a report?

It is unnecessary to file a report with any provinces because the company is federally regulated

All of the provinces where its customers are located

New Brunswick and British Columbia only

Which of the following specifically differentiates between regular personal information and employee-related or work-product information?

Personal Information Protection and Electronic Documents Act (PIPEDA).

British Columbia's Personal Information Protection Act

Personal Information Protection and Electronic Documents Act (PIPEDA).

Under PIPEDA, each of the following situations requires an organization to obtain express consent to use personal information EXCEPT?

If the information is publicly available as defined by the regulation.

If the use is outside of the reasonable expectations of an individual.

If the information is publicly available as defined by the regulation.

If the use is inconsistent with the original purpose.

If there is no risk of significant harm.

What is required for a provincial law to be considered substantially similar to the Personal Information Protection and Electronic Documents Act (PIPEDA)?

Consistency with the ten privacy principles, an independent oversight body and a redress mechanism.

Consistency with at least eight of the ten privacy principles, an independent oversight body and a complaint handling mechanism.

Consistency with the ten privacy principles, an independent oversight body and a process for accessing information.

Consistency with the ten privacy principles, an independent oversight body and a redress mechanism.

Consistency with the ten privacy principles, an appeal process and a redress mechanism.

A boutique hotel in Montreal seeks to attract travelers from Europe but wants to avoid becoming subject to the GDPR's requirements. Which of the following activities is most likely to result in a finding that the hotel is subject to the GDPR?

Translating the hotel's registration page into German based on the visitor's IP address.

Placing advertisements on travel websites accessible in Europe.

Collecting contact information for foreign business leaders from public directories.

Sending discount offers to guests who previously registered using a foreign address.

Translating the hotel's registration page into German based on the visitor's IP address.

In Ontario, a patient attends an appointment with a physician and reveals information about some new symptoms that she has been experiencing. Based on this information, the physician diagnoses the patient with a condition and prepares the report detailing the applicable history and diagnosis. The report is added to the patient's record. The patient later regrets revealing certain facts and doesn't want anyone else to know about these symptoms or the diagnosis. She acknowledges that the information she provided was correct and does not question the diagnosis.Which of the following requests would the patient be most successful at pursuing?

That the information be restricted from disclosure to other health care providers.

That a correction be made to change the diagnosis based on the patient's wishes.

That the information be restricted from disclosure to other health care providers.

That a copy of the record be kept by the patient for disclosure to physicians.

That details of the diagnosis be deleted from the patient's health record.

Which falls under the jurisdiction of the Personal Information Protection and Electronic Documents Act (PIPEDA)?

Personal information disclosed across provincial or national borders by organizations such as credit reporting agencies or list marketers.

Personal information collected by private businesses for journalistic or artistic purposes.

Personal health information (PHI) handled by private enterprises in provinces that have adopted substantially similar legislation.

Personal information disclosed across provincial or national borders by organizations such as credit reporting agencies or list marketers.

Personal information such as names, titles and contact information used by businesses to communicate with employees regarding their profession.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), when engaging in a third-party transfer of personal information for processing, an organization is expected to have the technology to protect the information during transit and to?

Establish a contract outlining the individual outsourcing arrangement.

Obtain additional consent for the use of the information by the third party.

Confirm the jurisdictional protections of the receiving organization are the same as PIPEDA.

Review the cross-border data flow competed and approved by the Treasury Board of Canada Secretariat.

According to the Privacy Act, which of the following disclosures of personal information by a government institution would require the data subject's consent?

When disclosing to a registered charitable organization.

When disclosing to a law enforcement body.

When disclosing to comply with a search warrant.

When disclosing to a registered charitable organization.

When disclosing to a member of parliament to assist in resolving a problem.

Under PIPEDA, each of the following are considered to be personal information EXCEPT?

A public official's salary published on a government web site.

A person's telephone number published in a public directory.

A photograph taken in public and published in a newspaper.

Information about a defendant contained in court records.

How would an individual determine whether their personal information was used by the federal government for data matching?

By noting the description of the Personal Information Banks available through Info Source.

By submitting written requests to the third party conducting data matching for the government

By noting the description of the Personal Information Banks available through Info Source.

By proposing a Privacy Impact Assessment (PIA) within the specific government body.

By reviewing the Privacy Commissioner's annual report.

In what situation is the federal Privacy Commissioner authorized to proceed to federal court?

For a determination of whether or not personal information was properly withheld from release.

For a determination on a ruling regarding privacy matters relating to the Charter of Rights and Freedom.

For a determination of whether or not personal information was properly withheld from release.

For a determination on a ruling by an administrative tribunal regarding privacy.

For a determination on a ruling by a provincial Privacy Commissioner.

What is the primary motivation for a federal government entity to complete a Privacy Impact Assessment (PIA)?

Receiving program approvals from the Treasury Board of Canada.

Introducing new legislation in the House of Commons

Receiving program approvals from the Treasury Board of Canada.

Obtaining program expertise from the Privacy Commissioner of Canada.

Improving collection methods through its information technology systems.

A company wants to invest in DEI initiatives within their organization and plans to survey employees by asking for locality, age, salary, gender, ethnicity, religion, sexual orientation, physical/mental disabilities, department, and job level.The best solution to protect the personal information collected in the survey is to?

Adjust all survey question so that no identifying information nan he collected

Use a pseudonym to identify employees.

Choose a survey tool located in Canada.

Encrypt the sensitive information collected and stored.

Adjust all survey question so that no identifying information nan he collected

What must an organization do to fulfill the Personal Information Protection and Electronic Documents Act's (PIPEDA) transparency requirements when transferring personal information to a foreign country?

Advise customers that their data may be accessed by another jurisdiction's courts or law enforcement.

Inform customers if data is to be transferred outside of Canada and solicit additional consent.

Give individuals with an existing business relationship the right to refuse transfer of their information.

Advise customers that their data may be accessed by another jurisdiction's courts or law enforcement.

Provide new customers with a measure-by-measure comparison of relevant foreign laws with Canadian laws.

A private sector daycare's portal for parents stores their children's photos, allergy information and date of birth. A parent has asked about the portal's security requirements and in three months still not has received an answer. What is missing from the daycare's procedures?

Responding to the parent's request within 30 days.

Ensuring strong encryption and security measures.

Completing a real risk of significant harm assessment (RROSH).

Which act also includes references to the Privacy Act?

The Children's Online Privacy Protection Act

The Telecommunications Intercept and Access (TIA) Act.

The Personal Information Protection and Electronic Documents Act

Which of the following provincial health acts is NOT considered substantially similar to the Personal Information Protection and Electronic Documents Act (PIPEDA)?

lAberta's Health Information Act (PHIA)

New Brunswick's Personal Health Information Privacy and Access Act (PHIPAA)

Ontario's Personal Health Information Protection Act (PHIPAA)

Nova Scotia's Personal Health Information Act (PHIPAA)

lAberta's Health Information Act (PHIA)

Which question is NOT part of the Office of the Privacy Commissioner of Canada's (OPC's) four-point test for establishing whether providing access to genetic testing results goes beyond what is necessary or reasonable?

Are the validity and accuracy of individual test results guaranteed to be accurate?

Are there less privacy-invasive alternatives?

Are the collection and the use proportionate to the benefits gained?

Are the validity and accuracy of individual test results guaranteed to be accurate?

Is the personal information likely to be effective in achieving a legitimate business purpose?

What is required of a private sector organization that is subject to a finding by a Canadian federal or

In Qubec, comply with the finding as a binding decision.

Comply with findings of the Privacy Commissioner of Canada only.

In all jurisdictions, adopt and apply the finding within 30 days of the published report.

In Ontario only, apply for judicial review within a provincial court in order to accept or refute the finding.

After an investigation under the Privacy Act, the Privacy Commissioner could do any of the following EXCEPT?

Order an institution to take remedial action if it determines that the Act has been breached.

Proceed to federal court to determine if the institution improperly withheld information from an individual.

Order an institution to take remedial action if it determines that the Act has been breached.

Recommend solutions to institutions to address identified shortcomings.

Compel institutions to give oral or written evidence.

In Ontario, personal information can be withheld from disclosure in a Freedom of Information (FOI) request. The following information is included in a record that is the subject of a FOI request being handled by a hospital: employee name, employee title, employee designation, employee educational history, employee personal cell phone number, and feedback about the employee from a colleague.Which of the following statements is accurate regarding what can be released?

Employee name, title, and designation can be released as it is not classified as personal information.

Employee name and title can only be released if the employee consents

The employee designation is not to be released as it is considered employment history.

Employee name, title, and designation can be released as it is not classified as personal information.

No employee information can be released as it is information that was collected throughout the course of employment.

In which instance is your personal information deemed publicly available?

You belong to a professional body and your name exists on a registry that meets legal requirements.

You volunteer for an organization and they register you on their contact list in order to book you for future shifts.

You applied to a variety of universities and your application data exists on a register by the admissions departments.

You contributed financial donations to your local church and your name exists on their list for income tax receipt purposes.

According to the Alberta Personal Information Protection Act, which of the following data breach reporting notifications to the commissioner is NOT automatically triggered when real risk of significant harm (RROSH) has been determined?

Providing an estimate of the number of individuals affected by the breach.

Providing a description of the steps the organization will take to notify the affected individual(s).

Providing a description of the steps the organization has taken to reduce or mitigate that harm.

Providing an estimate of the number of individuals affected by the breach.

Providing a description of the personal information involved in the breach.

A new client is opening a Registered Retirement Savings Plan. Their investment advisor asks for their social insurance number (SIN). The advisor must tell the client that because they are opening a tax reporting product, their SIN is mandatory for tax reporting purposes and?

Optional for identity verification purposes.

Mandatory for identity verification purposes.

Optional for secondary marketing purposes.

Mandatory for secondary marketing purposes.

Why is biometric information considered sensitive personal information in almost all circumstances?

It is distinctive, unlikely to vary overtime, difficult to change and largely unique to the individual.

It is user specific information that can easily be stored and accessed to identify an individual or group of individuals.

It can be applied broadly to link many pieces of personal information and creates security vulnerabilities.

It is distinctive, unlikely to vary overtime, difficult to change and largely unique to the individual.

It is easy to recognize and reproduce with increasing computer processing power.

Which of the following describes a difference between the federal Privacy Commissioner and provincial commissioners?

Provincial commissioners can order an organization to act.

Provincial commissioners are limited to recommending actions.

The federal commissioner has the power to make an organization comply.

The federal commissioner must receive complaints from a legislative representative.

According to the federal Privacy Commissioner, what protection is missing from the Privacy Act regarding outsourcing of government work that contains personal information?

A statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.

A statement preventing the vendor to whom the information is outsourced to subcontract its processing.

A statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.

A statement requiring the government agency to complete a Privacy Impact Assessment (PIA) prior to outsourcing to a third party.

A statement indicating that the government institution from which the information is outsourced remains accountable for its security.

In which circumstance do private sector privacy laws permit collection of information without consent?

When timely consent cannot be obtained by the organization and the collection is clearly in the individual's interests.

When the collection is necessary for the organization to complete a profile of the individual.

When the collection is reasonable for purposes related to the organization's mandate.

When the individual expressly waives their right to give consent.

What is critical to consider when an organization responsible for a large number of records wants to outsource the storage of those records?

Putting into place a contractual agreement between the organization and the records storage company.

Determining if the personal information stored on the records will be used for data matching

Putting into place a contractual agreement between the organization and the records storage company.

Conducting a Privacy Impact Assessment (PIA) prior to establishing a relationship with the storage company.

Establishing that consent gathered from individuals by the organization in order to store their personal information was informed and meaningful.

IAPP CIPP-C Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Which is NOT a Canadian Standards Association (CSA) Privacy Principle?

Personal information shall be protected by the same security safeguards regardless of the sensitivity of the information.

The purpose for which personal information is collected shall be identified by the organization at or before the time the information is collected.

The degree to which personal information must be kept accurate and complete is determined by whether its original purpose has been achieved.

Upon request, an individual shall be informed of the existence, use and disclosure of their personal information and shall be given access to that information.

Comment (0)

IAPP CIPP-C Practice Test 1

Question

IAPP CIPP-C Practice Tests

Practice Tests