IAPP Updated CIPP-C Exam Questions and Answers by michaela

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), personal information is defined as information about an identifiable individual. However, information that is publicly available, such as a public official's salary listed on a government website, is excluded from protection under PIPEDA's regulations specifying what constitutes publicly available information. The salaries of public officials, as government transparency measures, are specifically designated as public information. In contrast, the other options listed—telephone numbers in a public directory, photographs taken in public, and court records—although they might seem public, are not explicitly designated as exempt from PIPEDA in the same way, and could still be considered personal information depending on the context.

Individuals can determine whether their personal information was used by the federal government for data matching by referring to descriptions of the Personal Information Banks (PIBs) available through Info Source. Info Source is a series of publications and an online resource designed to assist individuals in understanding how the government manages personal information. It is managed by the Treasury Board of Canada Secretariat and provides information about the existence, purpose, and use of personal information banks within government institutions. This resource is the most direct and reliable way for individuals to identify how their personal data is handled and if it has been used for data matching purposes.

The collection and use of the individual’s name and email address by a British Columbia-based wellness app that has various non-healthcare related uses would fall under the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA applies to private sector organizations across Canada that handle personal information in the course of commercial activities, regardless of the province where the data is stored or the organization is based, as long as the activity is not exclusively within a province that has substantially similar provincial legislation to PIPEDA. Since the app is used for purposes beyond health care and operates inter-provincially, PIPEDA is the applicable legislation.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), there are specific circumstances where a commercial business in Canada is allowed to collect personal information without the knowledge or consent of the individual1. These exceptions include:

• Journalistic or literary purposes (option A): Organizations may collect personal information without consent when it’s for journalistic, artistic, or literary purposes, as these activities are considered to fall under the freedom of expression provisions.
• Interests of the individual (option B): If the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way, for example in emergency situations where the individual’s life, health, or security is threatened.
• Investigative purposes (option D): When the collection with the knowledge of the individual would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

However, option C is not one of the exceptions provided under PIPEDA. The act does not allow for the collection of personal information without consent solely on the basis that the collection would lead to the creation of products that would benefit the public and consent would be difficult to obtain. While public benefit is a consideration in the ethical use of personal information, it does not override the requirement for consent under PIPEDA unless the situation falls under other specific exceptions1.

Therefore, the correct answer is C, as it is the exception that is not permitted under the current framework of PIPEDA for collecting personal information without the knowledge or consent of the individual1.