CIPP-C - Certified Information Privacy Professional/ Canada (CIPP/C)

According to the Canadian Standards Association (CSA) Model Code, which has been adopted into PIPEDA, personal information should be retained only as long as necessary to fulfill the purposes for which it was collected. This principle ensures that personal information is not kept indefinitely without a valid reason, supporting data minimization and limiting potential privacy risks associated with unnecessary data retention. This principle is reflected in the CSA Model Code's retention guideline, which emphasizes the need to retain personal information only for the duration required to achieve its intended purpose. Therefore, the correct statement is Option D.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private sector organizations that operate across provincial or national borders in Canada in the course of commercial activities. Therefore, employees of an airline offering flights across Canada would be subject to PIPEDA because their employer operates in a federally regulated sector involving interprovincial transportation. The other examples given—underwriters for a New Brunswick insurance company, clerks at a Montreal credit union, and the IT department of a provincial government office in Saskatchewan—are subject to provincial privacy laws rather than PIPEDA. In the case of the credit union in Quebec and the insurance company in New Brunswick, provincial privacy laws apply to their operations within the province, and provincial public sector privacy laws cover the Saskatchewan Office of Residential Tenancies.

Under PIPEDA, any breach of security safeguards involving personal information that poses a real risk of significant harm (RROSH) requires reporting to the Office of the Privacy Commissioner of Canada (OPC). In the scenarios given, sending a sales report with aggregated information (option A) or a file with client data to wrong processors who cannot identify the clients (option B), or blocking an attempted hack (option C), may not necessarily pose a RROSH. However, a nursing home releasing an email with everyone's email address in the "to" section unredacted during a freedom of information request (option D) potentially exposes individuals to a risk of spam, phishing, and other malicious activities, thereby posing a real risk of significant harm. This constitutes a breach requiring reporting to the OPC.