Free CIPP-C sample questions

Correct answer: Knowledge and Consent

The primary issue is the lack of meaningful consent. The 'Knowledge and Consent' principle requires organizations to inform individuals of the purposes for the collection, use, or disclosure of personal information in a clear and understandable manner. A vague statement like 'improve services' does not adequately explain the collection of sensitive geolocation data, especially when collected in the background. The OPC's guidelines on meaningful consent emphasize clarity on what is being collected, for what purpose, and with whom it will be shared.

Correct answers: British Columbia's PIPA; The EU's GDPR

As the company is based in British Columbia, it is subject to BC's Personal Information Protection Act (PIPA) for the personal information of BC residents. BC PIPA includes mandatory breach notification requirements if a breach creates a real risk of significant harm.

The General Data Protection Regulation (GDPR) has extraterritorial reach and applies to any organization, regardless of location, that processes the personal data of individuals in the EU. Since German residents were affected, the company has a mandatory breach notification obligation under GDPR.

Correct answer: A Privacy Impact Assessment (PIA)

The Treasury Board Directive on Privacy Impact Assessment makes it mandatory for federal government institutions to conduct a PIA for new or substantially modified programs and activities involving personal information. Given the collection of sensitive biometrics and data linkage, a PIA is the required tool to identify and mitigate privacy risks before launch.

Correct answer: Implied consent within the circle of care

Ontario's Personal Health Information Protection Act (PHIPA) allows health information custodians to assume a patient's implied consent to share personal health information with other custodians involved in the patient's care, unless the patient has expressly withheld or withdrawn that consent. This concept is known as the 'circle of care'.

Correct answer: False

This statement is false. The Canadian Charter of Rights and Freedoms does not contain an explicit, standalone right to privacy. Instead, privacy rights have been interpreted by the courts as being implicitly protected under Section 7 ('the right to life, liberty and security of the person') and Section 8 ('the right to be secure against unreasonable search or seizure'). Privacy legislation like PIPEDA and the Privacy Act are the primary statutory sources.

Correct answer: The person with the highest authority in the organization

Quebec's Law 25 mandates that the person with the highest authority within the organization, such as the Chief Executive Officer (CEO), is by default the person in charge of the protection of personal information. This responsibility can be delegated in writing to another person.

Correct answer: CASL, for not honoring an unsubscribe request in a timely manner.

Canada's Anti-Spam Legislation (CASL) governs the sending of Commercial Electronic Messages (CEMs). While the initial message may have been sent under implied consent from an existing business relationship (valid for two years), CASL requires that all unsubscribe requests be honored without delay, and at the latest within 10 business days. Failing to process the request is a direct violation of CASL.

Correct answer: The complaint will be dismissed because PIPEDA does not apply to personal information collected, used, or disclosed for journalistic, artistic, or literary purposes.

PIPEDA contains a specific exemption for personal information that is collected, used, or disclosed for journalistic, artistic, or literary purposes and for no other purpose. This exemption is intended to balance privacy rights with freedom of expression. Therefore, the complaint would likely be dismissed as the activity falls outside PIPEDA's jurisdiction.

Correct answer: Ensure a contract is in place with the US vendor that provides a comparable level of protection to what is required under Canadian law.

Under PIPEDA's Accountability principle, when an organization transfers personal information to a third party for processing, it remains responsible for that information. The OPC's guidance explicitly states that the organization must use contractual or other means to provide a comparable level of protection. This includes safeguards, access rights, and limitations on use. This contract is the foundational element for ensuring compliance in a cross-border transfer scenario.

Correct answer: The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data

The Canadian Standards Association (CSA) Model Code, which is the foundation of PIPEDA's privacy principles, was based on the 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines. These guidelines established the foundational Fair Information Practice Principles (FIPPs) that are now common in privacy laws worldwide.