CIPP-C Exam Study Guide: The Ultimate 2026 Practice Test

In the scenario described, the most significant procedural flaw at the daycare is their failure to respond to the parent ' s request about the portal’s security measures within a reasonable time frame. Under the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations are required to respond to such requests within 30 days. This timeframe is mandated to ensure transparency and to provide individuals with timely access to information about the handling of their personal data. The daycare’s failure to provide an answer within this period violates PIPEDA ' s provisions regarding the access to personal information and the accountability of organizations in managing this data securely and transparently.

For a federally regulated company operating across multiple provinces, reporting obligations for a privacy breach involving personal information depend on the applicable provincial legislation as well as federal requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA requires that organizations report to the Privacy Commissioner of Canada any breach of security safeguards involving personal information that poses a real risk of significant harm. Additionally, provinces like Alberta and British Columbia have specific legislation that mandates reporting to provincial regulators. Quebec ' s privacy law also includes breach notification provisions. Therefore, the company must report the breach to both the federal Commissioner and the provincial privacy regulators in all provinces where its customers are affected if those provinces have mandatory breach reporting laws. This ensures compliance with both federal and applicable provincial laws. Thus, the correct answer is B, " All of the provinces where its customers are located. "

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), express consent is not required when the personal information is publicly available as defined by the regulation. According to the regulations specifying publicly available information under PIPEDA, certain types of information, like that published in directories or records where the individual has provided the information for public dissemination, are excluded from the consent requirement. This provision is aimed at balancing the need for privacy protection with the practicalities of information that has been intentionally made public by the individual or by legal requirement. The other options listed (A, C, D) generally require express consent as they involve uses of personal information that either extend beyond what the individual would reasonably expect, or change the context in which the information was originally collected.