Certified Information Privacy Professional/ Canada (CIPP/C) CIPP-C Exam Questions

In Ontario, as well as in most jurisdictions in Canada, once a patient discloses information to a healthcare provider, the information becomes part of their health record and cannot typically be altered or deleted based on the patient ' s subsequent regret or preference for privacy. Under privacy laws that apply to health information in Ontario, such as the Personal Health Information Protection Act (PHIPA), a patient does not have the right to have valid medical diagnoses removed or altered in their health record. However, they can request that the disclosure of their health information be restricted to certain persons or for certain purposes. Therefore, the patient would be most successful at pursuing Option B, requesting that the information be restricted from disclosure to other healthcare providers. This is supported by Section 20 of PHIPA, which allows individuals to withhold or withdraw consent for certain uses of their information, with necessary exceptions for emergency situations or other legally mandated disclosures.

According to the Canadian Standards Association (CSA) Model Code, which has been adopted into PIPEDA, personal information should be retained only as long as necessary to fulfill the purposes for which it was collected. This principle ensures that personal information is not kept indefinitely without a valid reason, supporting data minimization and limiting potential privacy risks associated with unnecessary data retention. This principle is reflected in the CSA Model Code ' s retention guideline, which emphasizes the need to retain personal information only for the duration required to achieve its intended purpose. Therefore, the correct statement is Option D.

The key difference between the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Personal Information Privacy Act (PIPA) of both Alberta and British Columbia is the scope of their application. PIPEDA applies to federal undertakings and to organizations that engage in commercial activities across provincial or national borders, thus under federal jurisdiction. In contrast, PIPA legislation in Alberta and British Columbia applies only to private organizations within those provinces, covering most commercial activities that do not cross provincial boundaries unless otherwise covered under federal law. This distinction highlights the division of legislative powers between federal and provincial levels concerning privacy regulation in Canada.

Before implementing an electronic service (e-service), a federal government department is required to complete a Privacy Impact Assessment (PIA) in accordance with Treasury Board guidelines. A PIA is a process that helps federal institutions to evaluate how new or substantially modified programs or services could affect individual privacy and to address those effects appropriately. The guidelines provided by the Treasury Board specify how PIAs should be conducted to ensure that all privacy risks are identified and mitigated before the implementation of a new or modified e-service. This requirement is crucial for maintaining the privacy and security of personal information handled by government departments.

The collection and use of the individual’s name and email address by a British Columbia-based wellness app that has various non-healthcare related uses would fall under the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA applies to private sector organizations across Canada that handle personal information in the course of commercial activities, regardless of the province where the data is stored or the organization is based, as long as the activity is not exclusively within a province that has substantially similar provincial legislation to PIPEDA. Since the app is used for purposes beyond health care and operates inter-provincially, PIPEDA is the applicable legislation.