IAPP CIPP-C Exam Questions : Certified Information Privacy Professional/ Canada (CIPP/C)

In Ontario, personal information can be withheld from disclosure in a Freedom of Information (FOI) request.
The following information is included in a record that is the subject of a FOI request being handled by a hospital: employee name, employee title, employee designation, employee educational history, employee personal cell phone number, and feedback about the employee from a colleague.
Which of the following statements is accurate regarding what can be released?

• A. No employee information can be released as it is information that was collected throughout the course of employment.
• B. Employee name and title can only be released if the employee consents
• C. The employee designation is not to be released as it is considered employment history.
• D. Employee name, title, and designation can be released as it is not classified as personal information.

A federally regulated company based in Ontario has customers in Ontario, Quebec, New Brunswick, Alberta and British Columbia. Unfortunately, a third-party vendor that provides marketing support to the company experiences a privacy breach which impacts the personal information of all its customers across the provinces where it operates.
The Privacy Officer determines that the breach causes a real risk of significant harm to their customers and is tasked with reporting the breach to the relevant regulators.
With which provincial privacy regulators does the company have to file a report?

• A. All of the provinces where its customers are located
• B. It is unnecessary to file a report with any provinces because the company is federally regulated
• C. New Brunswick and British Columbia only
• D. Quebec and Alberta only

Which act also includes references to the Privacy Act?

• A. The Personal Information Protection and Electronic Documents Act
• B. The Access to Information Act.
• C. The Children's Online Privacy Protection Act
• D. The Telecommunications Intercept and Access (TIA) Act.

Which of the following incidents will require reporting to OPC?

• A. A file with client ID, sales amount and sales date that was sent to the wrong processors who cannot identify the clients.
• B. As part of a freedom of information request, a nursing home that released an e-mail with everybody's e-mail address in the "to" section unredacted.
• C. An organization's point-of-sale system that was subject to an attempted hack that was blocked by the organization's firewall.
• D. A sales report with aggregated information that was sent to the wrong person internally.

A company wants to invest in DEI initiatives within their organization and plans to survey employees by asking for locality, age, salary, gender, ethnicity, religion, sexual orientation, physical/mental disabilities, department, and job level.
The best solution to protect the personal information collected in the survey is to?

• A. Choose a survey tool located in Canada.
• B. Encrypt the sensitive information collected and stored.
  D Adjust all survey question so that no identifying information nan he collected
• C. Use a pseudonym to identify employees.