Pass CIPP-C Exam Guide

The Privacy Act governs how federal government institutions handle personal information. The Privacy Commissioner of Canada has highlighted limitations within the Act regarding outsourcing, specifically:

• Lack of Explicit Accountability: While the Privacy Act implies the government institution remains responsible for the personal information, the Commissioner argues that the law needs a clearer, more explicit statement to ensure full accountability when it's outsourced.
• Outsourcing & Privacy Risks: Outsourcing government functions to third parties can add complexity and risk to the protection of personal information.
• References:

Why Other Options Are Less Relevant

• A. Preventing subcontracting: While controlling further subcontracting might be important, it's not the primary concern identified by the Commissioner.
• B. Commissioner's order power: While the Commissioner advocates for greater powers, this is not the specific gap in the Privacy Act related to outsourcing.
• C. Privacy Impact Assessments (PIAs): PIAs are crucial, but the Commissioner's argument highlights that even with PIAs, the Act lacks clear accountability language when the information leaves the government institution.

Key Points

• The Privacy Commissioner plays an advocacy role, identifying areas where privacy legislation could be strengthened.
• Accountability is crucial in all privacy contexts, especially when third parties handle sensitive data.

The principle of "Openness" in the Personal Information Protection and Electronic Documents Act (PIPEDA) has particularly contributed to the increase in privacy policies in recent years. This principle requires organizations to be open about their policies and practices regarding the management of personal information. They must make this information readily available in a form that is generally understandable. The emphasis on openness has compelled organizations to develop, maintain, and publish detailed privacy policies that outline how personal information is collected, used, disclosed, and protected. This requirement helps to ensure that individuals are informed about the privacy practices of organizations and can make informed decisions regarding their personal information.

Individuals can determine whether their personal information was used by the federal government for data matching by referring to descriptions of the Personal Information Banks (PIBs) available through Info Source. Info Source is a series of publications and an online resource designed to assist individuals in understanding how the government manages personal information. It is managed by the Treasury Board of Canada Secretariat and provides information about the existence, purpose, and use of personal information banks within government institutions. This resource is the most direct and reliable way for individuals to identify how their personal data is handled and if it has been used for data matching purposes.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), express consent is not required when the personal information is publicly available as defined by the regulation. According to the regulations specifying publicly available information under PIPEDA, certain types of information, like that published in directories or records where the individual has provided the information for public dissemination, are excluded from the consent requirement. This provision is aimed at balancing the need for privacy protection with the practicalities of information that has been intentionally made public by the individual or by legal requirement. The other options listed (A, C, D) generally require express consent as they involve uses of personal information that either extend beyond what the individual would reasonably expect, or change the context in which the information was originally collected.