PIPEDA Quiz: 12 Questions With Answers

Answer: 30 days after receiving the request

Section 8(3) sets the limit at 30 days after the organization receives the request, and it must act with due diligence. The 'one month plus two' option is the GDPR rule, and 45 days is the CCPA rule.

“An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request.”

Answer: Yes, by up to 30 more days in set cases, with a notice to the individual sent within the first 30 days

Section 8(4) allows up to 30 more days when meeting the limit would unreasonably interfere with the organization's activities or when needed consultations make it impracticable. The organization must send a notice of extension within 30 days of the request. A longer extension is allowed only for the time needed to convert the information into an alternative format. No approval from the Commissioner is needed.

“An organization may extend the time limit (a) for a maximum of thirty days if (i) meeting the time limit would unreasonably interfere with the activities of the organization”

Answer: The organization is deemed to have refused the request

Section 8(5) treats silence as a refusal. The individual can then complain to the Privacy Commissioner. Missing the deadline does not trigger an automatic fine.

“If the organization fails to respond within the time limit, the organization is deemed to have refused the request.”

Answer: Only at minimal or no cost, and only after telling the individual the approximate cost

Schedule 1 clause 4.9.4 says the response must be at minimal or no cost. Section 8(6) adds that a cost can be charged only if the organization has told the individual the approximate cost and the individual has confirmed they are not withdrawing the request. 'Always free' is the tempting wrong answer.

“An organization shall respond to an individual's request within a reasonable time and at minimal or no cost to the individual.”

Answer: Data portability

The 10 principles are accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. Data portability is a GDPR right. It is not one of PIPEDA's principles.

“4.10 Principle 10 — Challenging Compliance An individual shall be able to address a challenge concerning compliance with the above principles”

Answer: When it is reasonable to expect the individual would understand the nature, purpose and consequences of what they are consenting to

Section 6.1 ties validity to understanding. The test is whether the people the organization deals with would understand the nature, purpose and consequences of the collection, use or disclosure. PIPEDA does not require written consent, and a posted policy alone does not make consent valid.

“the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure”

Answer: Organizations that collect, use or disclose personal information in the course of commercial activities

Section 4(1) applies PIPEDA to personal information handled in the course of commercial activities. It also covers employee information at federal works, undertakings or businesses. Federal government institutions fall under the separate Privacy Act, and PIPEDA has no employee-count threshold.

“This Part applies to every organization in respect of personal information that (a) the organization collects, uses or discloses in the course of commercial activities”

Answer: Alberta, British Columbia and Quebec

The OPC names Alberta, British Columbia and Quebec. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have substantially similar laws only for personal health information. Even in those three provinces, PIPEDA still covers federally regulated businesses and personal information that crosses provincial or national borders.

“Alberta, British Columbia and Quebec have their own private-sector privacy laws that have been deemed substantially similar to PIPEDA.”

Answer: When it is reasonable to believe the breach creates a real risk of significant harm to an individual

Section 10.1(1) uses a 'real risk of significant harm' test, and the report is due as soon as feasible after the organization determines the breach occurred. The 72-hour rule is the GDPR rule, and the 500-person threshold comes from HIPAA. Affected individuals must also be notified when the same test is met.

“if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.”

Answer: 24 months

Section 10.3(1) of the Act requires a record of every breach, not only reportable ones. The Breach of Security Safeguards Regulations set the period at 24 months after the organization determines the breach occurred.

“an organization must maintain a record of every breach of security safeguards for 24 months after the day on which the organization determines that the breach has occurred.”

Answer: Up to $100,000

Section 28 makes knowingly breaking the breach-reporting and record-keeping rules an offence. The fine is up to $10,000 on summary conviction and up to $100,000 as an indictable offence. Much larger penalties appear in Bill C-36, which is not law.

“(b) an indictable offence and liable to a fine not exceeding $100,000.”

Answer: The Federal Court

After the Commissioner's report, the complainant (or the Commissioner, with the complainant's consent) can apply to the Federal Court. Section 16 lets the Court order changes to practices and award damages, including for humiliation. The Commissioner investigates and recommends but cannot make orders or impose fines.

“(c) award damages to the complainant, including damages for any humiliation that the complainant has suffered.”