Online Access Free CIPP-C Practice Test

Which statement is TRUE regarding health information privacy laws in Canada?

• A.In provinces where there are no health information privacy statutes, a combination of the public health regulations and the private sector privacy legislation apply.
• B.Obligations regarding accountability for health information are transferred when control is outsourced to a third party.
  B Emphasis is given lo personal information protection over the maintenance of the publicly funded healthcare system
• C.There is a significant amount of variation among provinces regarding the definition of consent and how the consent requirement is addressed.

According to the Canadian Standards Association (CSA) Model Code, how long should personal information be retained?

• A.Personal information should be retained as long as necessary for the fulfillment of the purpose of the collection.
• B.Personal information should be retained for at least two years after the last administrative use.
• C.Personal information should be retained indefinitely as long as consent has been given.
• D.Personal information should not be retained at all.

A boutique hotel in Montreal seeks to attract travelers from Europe but wants to avoid becoming subject to the GDPR's requirements. Which of the following activities is most likely to result in a finding that the hotel is subject to the GDPR?

• A.Collecting contact information for foreign business leaders from public directories.
• B.Translating the hotel's registration page into German based on the visitor's IP address.
• C.Placing advertisements on travel websites accessible in Europe.
• D.Sending discount offers to guests who previously registered using a foreign address.

A small commercial business in Canada was preparing a mailing to its customers when the letters and the envelopes were mismatched, causing 500 of 1000 letters to be sent to the wrong recipients. The letters contained the name and mailing address of the clients as well as account numbers and account balances.
The business has discovered this error as clients called to report receiving the wrong letter and expressing concern that their information has been breached. Which of the following is the most appropriate next step to take?

• A.A risk assessment must be completed to determine the real risk of significant harm (RROSH) to the clients.
• B.The 500 clients who were impacted must be immediately notified.
• C.The Office of the Privacy Commissioner (OPC) must be immediately notified.
• D.All 1000 clients must be sent new letters.

What is the Canadian Courts' role in reviewing decisions by provincial oversight authorities?

• A.Review and compare the oversight authority's decision or recommendation against those of other oversight authorities across Canada.
• B.Impose a prison sentence only, such as when an employee sells personal health information (PHI) for their own gain.
• C.Look at specific types of errors made by the oversight authority such as a misinterpretation of a term in the legislation
• D.Review all the investigative notes of the oversight authority, such as would be gathered during interviews.