IAPP Certified Information Privacy Professional/ Canada (CIPP/C) - CIPP-C Exam Practice Test

A. A statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.

B. A statement requiring the government agency to complete a Privacy Impact Assessment (PIA) prior to outsourcing to a third party.

C. A statement preventing the vendor to whom the information is outsourced to subcontract its processing.

D. A statement indicating that the government institution from which the information is outsourced remains accountable for its security.

A. By noting the description of the Personal Information Banks available through Info Source.

B. By reviewing the Privacy Commissioner's annual report.

C. By proposing a Privacy Impact Assessment (PIA) within the specific government body.

D. By submitting written requests to the third party conducting data matching for the government

A. It is unnecessary to file a report with any provinces because the company is federally regulated

B. All of the provinces where its customers are located

C. New Brunswick and British Columbia only

D. Quebec and Alberta only

A. It provides a more detailed set of guidelines regarding possible violations.

B. It provides a more streamlined process of complaint resolution.

C. It reduces the perception that compliance is a confrontational process.

D. It increases the power of the commissioner to enforce decisions.

A. The collection would lead to the creation of products that would benefit the public and consent would be difficult to obtain.

B. The collection is in the interests of the individual and the consent cannot be obtained in a timely way.

C. The collection, with the knowledge of the individual, would compromise the availability and accuracy of the information and the collection is reasonable for the purposes related to investigating

D. The collection is for journalistic or literary purposes.

A. Health information custodians or trustees be specified only by applicable law or regulation

B. Notification to the individual be made in the event of a data breach of personal health information (PHI) by an organization that is based in Canada

C. An individual's consent may be implied unless the individual has refused consent or if the purpose of the disclosure is not to provide health care.

D. Consent must be expressed or implied when a custodian discloses personal health information (PHI) to another custodian for the purpose of providing health care.

A. Collection directly relates to, and is necessary for, operating a program of that organization.

B. Collection is authorized by consent.

C. Collection is for the purposes of a law enforcement action.

D. Collection is expressly authorized under an act.

A. Information about a defendant contained in court records.

B. A public official's salary published on a government web site.

C. A person's telephone number published in a public directory.

D. A photograph taken in public and published in a newspaper.