Free CIPP-C sample questions

Correct answer: A Privacy Impact Assessment (PIA)

The Treasury Board Directive on Privacy Impact Assessment makes it mandatory for federal government institutions to conduct a PIA for new or substantially modified programs and activities involving personal information. Given the collection of sensitive biometrics and data linkage, a PIA is the required tool to identify and mitigate privacy risks before launch.

Correct answer: Implied consent within the circle of care

Ontario's Personal Health Information Protection Act (PHIPA) allows health information custodians to assume a patient's implied consent to share personal health information with other custodians involved in the patient's care, unless the patient has expressly withheld or withdrawn that consent. This concept is known as the 'circle of care'.

Correct answer: False

This statement is false. The Canadian Charter of Rights and Freedoms does not contain an explicit, standalone right to privacy. Instead, privacy rights have been interpreted by the courts as being implicitly protected under Section 7 ('the right to life, liberty and security of the person') and Section 8 ('the right to be secure against unreasonable search or seizure'). Privacy legislation like PIPEDA and the Privacy Act are the primary statutory sources.

Correct answer: The person with the highest authority in the organization

Quebec's Law 25 mandates that the person with the highest authority within the organization, such as the Chief Executive Officer (CEO), is by default the person in charge of the protection of personal information. This responsibility can be delegated in writing to another person.

Correct answer: CASL, for not honoring an unsubscribe request in a timely manner.

Canada's Anti-Spam Legislation (CASL) governs the sending of Commercial Electronic Messages (CEMs). While the initial message may have been sent under implied consent from an existing business relationship (valid for two years), CASL requires that all unsubscribe requests be honored without delay, and at the latest within 10 business days. Failing to process the request is a direct violation of CASL.

Correct answer: The complaint will be dismissed because PIPEDA does not apply to personal information collected, used, or disclosed for journalistic, artistic, or literary purposes.

PIPEDA contains a specific exemption for personal information that is collected, used, or disclosed for journalistic, artistic, or literary purposes and for no other purpose. This exemption is intended to balance privacy rights with freedom of expression. Therefore, the complaint would likely be dismissed as the activity falls outside PIPEDA's jurisdiction.

Correct answer: Ensure a contract is in place with the US vendor that provides a comparable level of protection to what is required under Canadian law.

Under PIPEDA's Accountability principle, when an organization transfers personal information to a third party for processing, it remains responsible for that information. The OPC's guidance explicitly states that the organization must use contractual or other means to provide a comparable level of protection. This includes safeguards, access rights, and limitations on use. This contract is the foundational element for ensuring compliance in a cross-border transfer scenario.

Correct answer: The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data

The Canadian Standards Association (CSA) Model Code, which is the foundation of PIPEDA's privacy principles, was based on the 1980 Organisation for Economic Co-operation and Development (OECD) Guidelines. These guidelines established the foundational Fair Information Practice Principles (FIPPs) that are now common in privacy laws worldwide.

Correct answer: A discretionary exemption related to advice or recommendations

The Privacy Act contains several exemptions to the right of access. Section 21 provides a discretionary exemption for records containing advice or recommendations developed by or for a government institution or a minister of the Crown. This allows the government to protect the deliberative process. The institution has the discretion to release the information if it does not harm the deliberative process.

Correct answer: The research project must have been reviewed and approved by a Research Ethics Board.

Alberta's HIA, similar to other provincial health privacy laws, permits the disclosure of health information for research purposes without consent under strict conditions. A key requirement is that the research plan has been submitted to and approved by a Research Ethics Board (REB) that meets the standards set out in the legislation. The REB assesses the ethical implications, privacy risks, and scientific merit of the project.