CIPP-C Sample Questions & Answers

Quebec's Law 25 mandates that the person with the highest authority within the organization, such as the Chief Executive Officer (CEO), is by default the person in charge of the protection of personal information. This responsibility can be delegated in writing to another person.

Canada's Anti-Spam Legislation (CASL) governs the sending of Commercial Electronic Messages (CEMs). While the initial message may have been sent under implied consent from an existing business relationship (valid for two years), CASL requires that all unsubscribe requests be honored without delay, and at the latest within 10 business days. Failing to process the request is a direct violation of CASL.

PIPEDA contains a specific exemption for personal information that is collected, used, or disclosed for journalistic, artistic, or literary purposes and for no other purpose. This exemption is intended to balance privacy rights with freedom of expression. Therefore, the complaint would likely be dismissed as the activity falls outside PIPEDA's jurisdiction.

Under PIPEDA's Accountability principle, when an organization transfers personal information to a third party for processing, it remains responsible for that information. The OPC's guidance explicitly states that the organization must use contractual or other means to provide a comparable level of protection. This includes safeguards, access rights, and limitations on use. This contract is the foundational element for ensuring compliance in a cross-border transfer scenario.

The Canadian Standards Association (CSA) Model Code, which is the foundation of PIPEDA's privacy principles, was based on the 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines. These guidelines established the foundational Fair Information Practice Principles (FIPPs) that are now common in privacy laws worldwide.

The Privacy Act contains several exemptions to the right of access. Section 21 provides a discretionary exemption for records containing advice or recommendations developed by or for a government institution or a minister of the Crown. This allows the government to protect the deliberative process. The institution has the discretion to release the information if it does not harm the deliberative process.

Alberta's HIA, similar to other provincial health privacy laws, permits the disclosure of health information for research purposes without consent under strict conditions. A key requirement is that the research plan has been submitted to and approved by a Research Ethics Board (REB) that meets the standards set out in the legislation. The REB assesses the ethical implications, privacy risks, and scientific merit of the project.

The Treasury Board of Canada Secretariat's Directive on Automated Decision-Making requires federal institutions to complete an Algorithmic Impact Assessment (AIA) before deploying an automated decision system. The AIA is a risk assessment framework designed to help institutions better understand and mitigate the risks associated with these systems, including impacts on clients, operations, and legal compliance.

In provinces that have enacted 'substantially similar' private-sector privacy legislation (like Alberta, BC, and Quebec), the provincial law applies to provincially regulated organizations within that province. PIPEDA continues to apply to federal works, undertakings, or businesses (FWUBs) such as banks, airlines, and telecommunications companies, regardless of their location, and to interprovincial/international data flows.

PIPEDA [Section 7(3)(c.1)] allows an organization to disclose personal information without consent to a government institution that has identified its lawful authority to obtain the information and the disclosure is requested for the purpose of enforcing any law, carrying out an investigation, or gathering intelligence. The key elements are a written request, identification of lawful authority, and a specified purpose. This is a narrow exception and requires careful documentation.