Free CIPP-C Practice Test Questions and Answers (2026)

Under Ontario's Personal Health Information Protection Act (PHIPA), a patient has the right to direct a health information custodian not to share their personal health information with other custodians. This is commonly known as the "lock-box" provision. Since the patient's goal is to prevent others from knowing about the diagnosis, requesting a restriction on disclosure is the most appropriate and legally supported action. The information itself is accurate, so correction or deletion is not applicable. The lock-box allows the patient to control the flow of their information among healthcare providers, directly addressing their concern.

A. Correction is only for inaccurate or incomplete information. The scenario states the diagnosis is correct, so a request to change it would be denied.
C. While a patient has a right to a copy of their record, this action does not achieve their goal of restricting others from seeing the information.
D. Deletion of accurate and relevant clinical information from a health record is not a patient right under PHIPA; custodians must maintain complete records.

1. Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Schedule A, Section 37(1)(a) regarding express consent for disclosure.

2. Information and Privacy Commissioner of Ontario (IPC). (2015). Circle of Care: Sharing Personal Health Information for Health-Care Purposes. Fact Sheet, p. 3. Discusses the patient's right to withhold or withdraw consent (the lock-box).

3. Information and Privacy Commissioner of Ontario (IPC). (2019). Your Health Information and Your Privacy Rights. Fact Sheet, p. 2. Explains the right to "lock" or block access to parts of a patient's health record.

The Treasury Board of Canada Secretariat's Directive on Privacy Impact Assessments applies to government institutions as defined in section 3 of the Privacy Act. While ministries, the Bank of Canada, and most Crown corporations are listed as government institutions subject to the Privacy Act, the Act contains a specific and broad exemption for "confidences of the Queen's Privy Council for Canada," which includes Cabinet confidences. Therefore, the functions and confidential records of the Cabinet as a collective body are not subject to the Privacy Act or its associated directives, including the one on PIAs.

A. The Ministry of Health is a core government department and is explicitly subject to the Privacy Act and its directives.
B. The Bank of Canada is listed in the Schedule of the Privacy Act as a government institution to which the Act applies.
C. Parent Crown corporations are generally defined as government institutions under the Privacy Act and are therefore subject to the directive.

1. Privacy Act, R.S.C., 1985, c. P-21, Section 3 (Definition of "government institution") and the Schedule.

2. Privacy Act, R.S.C., 1985, c. P-21, Section 70(1), which states the Act does not apply to confidences of the Queen's Privy Council for Canada.

3. Treasury Board of Canada Secretariat. (2010). Directive on Privacy Impact Assessment. Section 5.1 states the directive applies to government institutions as defined in section 3 of the Privacy Act.

Biometric information is considered highly sensitive due to its unique characteristics. It is intrinsically linked to an individual, is generally stable throughout their life, and, most critically, cannot be easily changed or revoked if compromised. Unlike a password or an identification number that can be reissued, a person's fingerprint or iris pattern is permanent. This combination of being distinctive, permanent, and largely unchangeable makes the potential harm from its misuse or unauthorized disclosure particularly severe, thus classifying it as sensitive personal information that requires the highest level of protection.

A. While true, this description is too general and could apply to other, less sensitive identifiers like a name or email address.
B. This describes a potential consequence of a biometric data breach, not the fundamental reason why the information itself is inherently sensitive.
D. The increasing ease of reproduction with technology is a risk factor, but the core sensitivity stems from the information's permanent and unchangeable nature.

1. Office of the Privacy Commissioner of Canada. (2018). Consultation on the OPC’s Proposals for ensuring appropriate regulation of Artificial Intelligence. Section "Defining the scope of the law". The OPC notes biometrics are "generally considered sensitive".

2. Cavoukian, A. (2011). Biometric Encryption: A Positive-Sum Technology that Achieves Strong Authentication, Security and Privacy. Information and Privacy Commissioner of Ontario. p. 3.

3. Kindt, E. J. (2013). Privacy and Data Protection Issues of Biometric Applications: A comparative Legal Analysis. Springer Science & Business Media. p. 57. DOI: 10.1007/978-94-007-7522-0.

The Access to Information Act (ATIA) and the Privacy Act are complementary statutes governing information held by federal government institutions in Canada. The ATIA provides a right of access to government records, while the Privacy Act governs the collection, use, and disclosure of personal information and provides a right of access to one's own information. The ATIA contains numerous references to the Privacy Act, particularly in its exemption provisions. For example, section 19 of the ATIA explicitly exempts information from disclosure if its release is prohibited under the Privacy Act. This demonstrates their interconnected design to balance transparency and privacy.

B. The Children's Online Privacy Protection Act (COPPA) is a United States federal law and does not reference Canada's Privacy Act.
C. The Telecommunications Intercept and Access (TIA) Act is not a Canadian statute; Canada has laws like Part VI of the Criminal Code for lawful access.
D. PIPEDA governs the private sector, while the Privacy Act governs the federal public sector. They operate in parallel and do not typically cross-reference each other.

1. Access to Information Act (R.S.C., 1985, c. A-1), Section 19(1). "Subject to subsection (2), the head of a government institution shall refuse to disclose any record requested under this Part that contains personal information." The definition of "personal information" is tied to the Privacy Act.

2. Department of Justice Canada. (2022). The Access to Information Act and The Privacy Act: A Guide for Federal Government Institutions. "The ATIA and the Privacy Act are two distinct but complementary pieces of legislation... Section 19 of the ATIA is a mandatory class-based exemption for personal information as defined in section 3 of the Privacy Act."

3. Currie, R. J. (2016). Protecting privacy in the digital era: The new meaning of 'reasonable expectation of privacy'. University of New Brunswick Law Journal, 67, 116-145. (Discusses the interplay between the Privacy Act and ATIA in the context of federal information management).

The Accuracy principle is a fundamental Fair Information Practice Principle (FIPP) that directly addresses the need for data quality. Under Canada's PIPEDA (Schedule 1, Principle 4.6), this principle requires that "Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used." The organization's obligation is to take reasonable steps to ensure the information is correct to avoid making misinformed decisions about an individual. This aligns perfectly with the scenario of verifying information to prevent incorrect actions.

A: Integrity is a security principle concerned with protecting data from unauthorized alteration, not ensuring its factual correctness for a purpose. C: Accountability is the overarching principle that an organization is responsible for complying with all privacy principles, not a specific data quality rule. D: Limiting purposes refers to the principle of specifying the reasons for data collection, not the quality of the data collected.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Schedule 1, Principle 4.6 "Accuracy".

2. Office of the Privacy Commissioner of Canada. (n.d.). PIPEDA fair information principles. Retrieved from the official OPC website, which details the 10 principles.

3. Organisation for Economic Co-operation and Development (OECD). (2013). The OECD Privacy Framework. OECD Publishing, Paris. Part Two, Section III, "Data Quality Principle".

The "Openness" principle (Principle 8 of Schedule 1 of PIPEDA) is the primary driver for the proliferation of privacy policies. This principle mandates that organizations must be open about their policies and practices regarding the management of personal information. They are required to make this information readily available in a form that is generally understandable. The most common and effective way for organizations to meet this requirement is by creating and publishing a comprehensive privacy policy on their websites and in other accessible formats.

A. This principle governs what an organization can do with information after it has been collected, not the public declaration of its practices.
B. This principle establishes an individual's right to access and challenge the accuracy of their personal information held by an organization, not the organization's general policies.
D. This principle requires that personal information be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Schedule 1, Principle 4.8 (Openness). "An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information."

2. Office of the Privacy Commissioner of Canada. (2019). PIPEDA in brief. "Be open about your privacy practices. This is your 'openness' principle. It is linked to the 'knowledge and consent' principle. For consent to be meaningful, individuals must understand what they are consenting to."

3. University of Toronto, Faculty of Law. (Course Material). Privacy Law. The course materials on PIPEDA's Fair Information Principles explicitly link the Openness principle to the legal and practical requirement for organizations to develop and publicize privacy policies.

The company is a federally regulated work, undertaking, or business (FWUB). As such, it is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) in all provinces, regardless of whether a province has its own "substantially similar" privacy legislation. PIPEDA's breach reporting requirements mandate reporting to the Office of the Privacy Commissioner of Canada (OPC) when there is a real risk of significant harm. The provincial private-sector privacy laws in Alberta, British Columbia, and Quebec contain exemptions for FWUBs, meaning they do not have jurisdiction. Therefore, the company's reporting obligation is to the federal commissioner, not any provincial regulators.

B. This is incorrect because provincial laws in Alberta, BC, and Quebec exempt federally regulated businesses from their scope, so reporting to all provincial regulators is not required.
C. This is incorrect. While BC has its own privacy law, it exempts federally regulated businesses. New Brunswick does not have its own private-sector privacy law.
D. This is incorrect. The privacy laws of Quebec and Alberta do not apply to federally regulated businesses, which fall under the exclusive jurisdiction of PIPEDA.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), s. 4(1)(a). This section establishes PIPEDA's application to every federal work, undertaking or business.

2. Office of the Privacy Commissioner of Canada. (2018). What you need to know about mandatory reporting of breaches of security safeguards. "If PIPEDA applies to your organization, you must report breaches to our Office... This is the case even if your organization operates in Alberta, British Columbia or Quebec".

3. Personal Information Protection Act, SA 2003, c P-6.5, s. 3(2)(e). This section explicitly states the Alberta Act does not apply to "any federal work, undertaking or business".

4. Personal Information Protection Act, SBC 2003, c 63, s. 3(2)(e). This section explicitly states the British Columbia Act does not apply to "any federal work, undertaking or business".

The enforcement powers of privacy commissioners vary significantly across Canadian jurisdictions. In Québec, the Commission d'accès à l'information (CAI) has order-making power under the Act respecting the protection of personal information in the private sector. This means its findings and decisions following an investigation are legally binding and organizations must comply with them, subject to appeal to the Court of Québec. In contrast, the federal Privacy Commissioner's findings under PIPEDA are recommendations and are not, by themselves, binding orders. Other provinces like British Columbia and Alberta also grant their commissioners order-making powers.

B. Findings of the Privacy Commissioner of Canada under PIPEDA are recommendations, not legally binding orders that compel compliance.
C. This is incorrect as enforcement powers are not uniform; some commissioners issue recommendations while others issue binding orders.
D. While judicial review is a mechanism to challenge a binding order, it is not exclusive to Ontario, nor is it the primary requirement.

1. Act respecting the protection of personal information in the private sector, CQLR c P-39.1, ss. 82, 90.1. (Grants the Commission the power to make orders).

2. Gautrais, V., & Décarie, I. (2019). The Droit à l’oubli in Québec: A Right to Erasure Avant la Lettre. In S. S.GRUß & S. C. van der Hof (Eds.), The data subject's right to erasure (pp. 107-126). T.M.C. Asser Press. (Discusses the binding nature of CAI decisions).

3. Office of the Privacy Commissioner of Canada. (2021). PIPEDA in brief. "The Commissioner's powers include... make non-binding recommendations". [Available at OPC website].

The most direct procedural failure is the daycare's non-compliance with the mandated response time for an access request. Under PIPEDA's Principle 4.9 (Individual Access), and specifically section 8(3) of the Act, an organization must respond to a request for information within 30 days of its receipt. The parent's inquiry about security requirements for their child's personal information constitutes such a request. By failing to respond for three months, the daycare has violated this explicit timeline. While transparency and security are important, the immediate, quantifiable breach of procedure is the failure to provide a timely response.

A. A lack of transparency is a broader issue; the specific violation here is the failure to meet the statutory deadline for a response, which is a component of transparency.
C. While strong security is required, the question is about the failure to respond to an inquiry about security, not about the security measures themselves.
D. A RROSH assessment is conducted after a breach has occurred to determine reporting obligations, not in response to a parent's general inquiry.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Section 8(3). "An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request."

2. Office of the Privacy Commissioner of Canada. (2019). PIPEDA in Brief. "Individuals have the right to access the personal information held by an organization... Organizations must respond to an access request within 30 days."

3. Bennett, C. J., & Raab, C. D. (2006). The Governance of Privacy: Policy Instruments in Global Perspective. MIT Press. (Discusses individual access rights as a core component of data protection regimes like PIPEDA, including specified time limits for responses).

The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal privacy law that applies to private-sector organizations in the course of commercial activities. While Alberta and British Columbia have their own substantially similar provincial privacy laws (PIPA), PIPEDA applies to all interprovincial and international transactions involving personal information. Since the individual is in Alberta and the software provider is in British Columbia, the collection and use of personal information across provincial borders falls under federal jurisdiction, making PIPEDA the applicable legislation.

A. Alberta’s HIA applies to health information held by health custodians in Alberta, which is not the case here.
B. Alberta’s PIPA applies to private organizations operating within Alberta, but PIPEDA governs the interprovincial flow of data.
C. Alberta’s FOIP applies to public bodies in Alberta, not to a private commercial software provider.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Section 4(1)(b). The Act applies to every organization in respect of personal information that is collected, used or disclosed in the course of a commercial activity.

2. Office of the Privacy Commissioner of Canada. (2023). PIPEDA in brief. "PIPEDA applies to the collection, use or disclosure of personal information in the course of a commercial activity... It also applies to all interprovincial and international flows of personal information."

3. University of Alberta, Faculty of Law. Course: LAW 589 - Information and Privacy Law. Course materials on jurisdictional issues in Canadian privacy law, explaining PIPEDA's application to interprovincial data transfers regardless of the existence of provincial legislation.

The Motor Vehicle Safety Act (MVSA) is the least effective framework for addressing the broad spectrum of emerging AI issues because its scope is narrowly confined to the safety of motor vehicles. While critical for autonomous driving, it has no applicability to the vast majority of AI applications and their associated societal risks, such as algorithmic bias in hiring or lending, misinformation from generative AI, or privacy issues in AI-powered healthcare. The other acts have much broader applicability to diverse AI challenges.

A. The Canada Consumer Product Safety Act can address AI embedded in a wide range of consumer goods, from smart toys to home assistants.
C. The Copyright Act is highly relevant to generative AI, addressing core issues of training data and ownership of AI-created content.
D. The Criminal Code provides a fundamental framework for addressing the malicious use of any technology, including AI, for fraud, harassment, or other offenses.

1. Teresa Scassa. (2023). Getting AI Regulation Right in Canada. Centre for International Governance Innovation (CIGI) Paper No. 277. This paper discusses the legislative landscape, noting that while sector-specific laws exist, they create a "patchwork of rules" (p. 5) and that broad issues like bias are not adequately addressed by narrow statutes like the MVSA.

2. Government of Canada. (2023). A guide to the Artificial Intelligence and Data Act (AIDA). The introduction of AIDA itself signals the government's recognition that existing laws, including sector-specific ones like the MVSA, are insufficient to address the full range of risks posed by "high-impact" AI systems across the economy.

Pseudonymization is a specific de-identification process where direct identifiers (e.g., name, Social Insurance Number) are replaced with a reversible, consistent value, or a "pseudonym." This substitution allows for data analysis and processing without exposing the original direct identifiers. Crucially, the organization holds a separate key or table that allows for the re-identification of the data subject if necessary and authorized. This differs from anonymization, where the intent is to irreversibly remove the ability to re-identify individuals.

A. Shuffling involves rearranging the order of records to obscure links between individuals and their data, not substituting elements.
B. Encryption is a method of rendering data unreadable, a security control that can be used for pseudonymization but is not the process itself.
C. Anonymization is the outcome of a process that makes re-identification not reasonably likely; pseudonymization is one specific technique to achieve this.

1. Office of the Privacy Commissioner of Canada & Information and Privacy Commissioner of Ontario. (2016). De-identification Guidelines for Structured Data. Page 6. "Pseudonymization is a technique that replaces a direct identifier with a pseudonym."

2. Cavoukian, A., & El Emam, K. (2011). Dispelling the Myths of De-identification: Anonymization and Pseudonymity. Information and Privacy Commissioner of Ontario. Page 4. This paper defines pseudonymity as involving the replacement of identifiers.

The Federal Court in Eastman v. Canada (Attorney General), 2005 FC 1605, determined that the collection of personal information via video surveillance occurs at the moment of recording. The court reasoned that the act of creating a permanent or lasting image of an identifiable individual constitutes "collection" under the Privacy Act. The subsequent viewing or use of the footage is a separate act from the initial collection, which is completed once the recording is made.

B. A camera being on without recording does not create a permanent record, which was the basis for the court's finding of "collection."
C. The collection happens when the image is captured and recorded, not when the data is subsequently moved or saved to a different location like a server.
D. Viewing the recording constitutes a "use" of the personal information, which occurs after the information has already been collected.

1. Eastman v. Canada (Attorney General), 2005 FC 1605, [2006] 3 F.C.R. 233. The court's decision focuses on the act of recording as the point of collection. Specifically, at para 33: "I am of the view that the videotaping of the applicant constituted the collection of his personal information."

2. Office of the Privacy Commissioner of Canada. (2008). PIPEDA Case Summary #2008-390: Video surveillance of public space from inside a store found to be inappropriate. The OPC's analysis consistently treats the act of recording as the collection of personal information, in line with the Eastman precedent.

The Privacy Act governs personal information held by federal government institutions. Section 19(2) of the Act specifies that it does not apply to personal information that the Royal Canadian Mounted Police (RCMP) collects while performing policing services for a province or municipality under contract, provided that the province or municipality has its own access to information and privacy legislation. In such cases, the request falls under provincial jurisdiction, not the federal Privacy Act, and would therefore be denied as being outside the Act's scope.

B. Section 22(1)(b) allows denial for information from a foreign state, but this exemption is voided if the foreign state consents to the disclosure.
C. This is an incorrect interpretation. Section 22.3 allows refusal for information that could harm a vulnerable species, but this is not a valid reason to deny access to one's own personal information.
D. Section 22(2) states that the law enforcement exemption ceases to apply after 20 years, meaning the information must be disclosed, not denied.

1. Privacy Act (R.S.C., 1985, c. P-21), Section 19(2). This section explicitly carves out an exception for the RCMP's provincial and municipal policing activities where applicable local laws exist.

2. Royal Canadian Mounted Police. (2021). Access to Information and Privacy (ATIP) Annual Report 2020-2021. This report discusses the RCMP's mandate under the Privacy Act and the distinction between its federal and contract policing roles, referencing the applicability of provincial legislation.

Canada's federal private sector privacy law, PIPEDA, operates on a consent-based model. However, it provides specific and limited exceptions where personal information can be collected without an individual's knowledge or consent. One such explicit exception, found in Section 7(1)(a) of the Act, permits collection without consent if it is "clearly in the interests of the individual and consent cannot be obtained in a timely way." A common example is collecting health information about an unconscious person during a medical emergency. This exception balances the principle of consent with practical situations where obtaining it is impossible and the collection directly benefits the individual.

B. Profiling an individual is a purpose for collection that generally requires clear, informed consent, not an exception to it.
C. The "reasonable purpose" test applies to the purposes for which consent is sought, not as a standalone justification for collecting information without any consent.
D. While an individual can provide consent, a general "waiver" of the right to consent is not a recognized exception for collection under Canadian private sector privacy laws.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), s. 7(1)(a). The text states an organization may collect personal information without knowledge or consent if "the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way".

2. Office of the Privacy Commissioner of Canada. (2019). PIPEDA in brief. "Your organization can’t collect personal information without consent unless it meets one of the exceptions. For example, you may collect personal information without consent if it is clearly in the individual’s interest and you can’t get their consent in a timely way".

3. Bennett, C. J., & Raab, C. D. (2006). The Governance of Privacy: Policy Instruments in Global Perspective. MIT Press. This academic text discusses exceptions to consent in data protection regimes, noting that emergency situations or the vital interests of the data subject are common and necessary exceptions. (p. 88).