Deck 35: What are the requirements under Canada's Anti-Spamming Legislation?

Question 1

In terms of sending commercial electronic information under Canada's Anti-Spamming Legislation,which of the following is not an exemption?

A)A business can request personal information from new potential customers.
B)A business can respond to an inquiry or request for a cost estimate.
C)The business can respond to a complaint.
D)A business can communicate to satisfy a legal obligation such as dispensing a warranty or product recall information.
E)A charity can send messages for fundraising purposes.

Answer 1

A

Question 2

Which of the following is not a part of the responsibilities of the Chief Privacy Officer?

A)Ensure that customers know what their privacy rights are when they interact with the company.
B)Destroy personal information that is no longer required even with there are no policies or procedures for the destruction of personal information being in place.
C)Ensure there are physical safeguards to personal information.
D)Ensure there are technological safeguards to protecting personal information.
E)Develop and implement the company's policies surrounding the handling of personal information.

Answer 2

B

Question 3

You receive an electronic spam message.Which of the following would not be of concern?

A)Introduction of a dangerous virus to your computer system.
B)Introduction of dangerous malware to your computer system.
C)The theft of your identify.
D)Access to your computer bank account.
E)All of the above would be of concern.

Answer 3

E

Question 4

If a customer complains about the use of their personal information,which of the following is not true?

A)Your firm may end up paying a fine.
B)The Privacy Commissioner may get involved.
C)Your firm's chief privacy officer may get involved.
D)The Federal Court of Canada may ultimately get involved.
E)You will not face any potential legal liability.

Question 5

If your company does not receives explicit consent from the recipient to receive commercial electronic information,then the consent

A)is temporary in nature.
B)needs to be replaced by express consent.
C)requires an easy-to-use unsubscribe function.
D)requires a no-cost unsubscribe function.
E)none of the responses are correct.

Question 6

If a breach of employee's privacy has taken place,the onus is on whom to show that the breach was reasonable under the circumstances?

A)The organization.
B)The employee.
C)The Privacy Commissioner.
D)Te judge of the court.
E)The union.

Question 7

The objective of the PIPEDA is to establish and encourage best practices,rather than to entrench an enforcement regime.

Question 8

If an investigation by the Chief Privacy Officer (CPO)reveals a breach in the firm's privacy protection procedures,the CPO must

A)amend the company's policies and procedures that prove to be contrary to the legislation.
B)resign immediately.
C)pursue court action.
D)engage in research into privacy issues.
E)promote public awareness of privacy issues.

Question 9

Your company receives a complaint from a customer regarding the use of personal information.What should take place?

A)The chief privacy officer should investigate the complaint.
B)The policies related to the firm's privacy protection should be amended.
C)Atrial should be initiated by the firm.
D)The customer should be compensated.
E)A demand should be made for particulars.

Question 10

You are a customer and believe your personal information has been misused by a company.Who should you first contact to file a complaint?

A)The Ontario Court of Justice.
B)The Office of the Privacy Commissioner of Canada.
C)The Federal Court.
D)The Supreme Court of Canada.
E)The Better Business Bureau.

Question 11

The Office of the Privacy Commissioner of the Canada has the capacity to investigate complaints.

Question 12

In a recent case in Ontario,the court determined that breach of privacy can be considered a tort.Which of the following was not a factor assessed by the judge?

A)Whether the firm acted in a discriminatory manner.
B)Intentional conduct of the defendant.
C)Unlawful invasion of the plaintiff's private affairs.
D)The harm caused as a reasonable consequence of the conduct.
E)Reckless conduct of the defendant.

Question 13

Greentree Financing Ltd.enters into an agreement to lend $20,000 to Mark for the purchase of a boat.On the loan application Mark provided the following information: address,telephone,social insurance number,employer,annual earnings and banking information.Mark agreed to the collection of the information for the purpose of assessing his suitability for the loan.What steps must Greentree take to protect Mark's information?

A)Greentree must designate an individual accountable for compliance with the Act.
B)Greentree must make information about its policies and practices regarding personal information available to Mark.
C)Mark may have access to his information,upon request.
D)Greentree must have appropriate safeguards to protect the information.
E)All of the steps are required.

Question 14

The standard against which the actions of a business will be held accountable for disclosing personal information without consent is one of reasonableness.

Question 15

Greentree Financing Ltd.enters into an agreement to lend $20,000 to Mark for the purchase of a boat.On the loan application Mark provided the following information: address,telephone,social insurance number,employer,annual earnings and banking information.Mark agreed to the collection of the information for the purpose of assessing his suitability for the loan.How else can Greentree use this information?

A)Soliciting Mark with other offers for other financial products offered by Greentree.
B)Providing the information to Greentree affiliate companies.
C)Selling the information to other unaffiliated companies to solicit Mark with other offers for financial products.
D)Contacting his employer to determine if he is in a permanent job.
E)Greentree cannot use the information for any of these purposes.

Question 16

Under the PIPEDA,suppliers and contractors of the company are not required to safeguard the personal information of the clients of the company.

Question 17

There is a four-part test to determine the reasonableness of the action of an organization that has allowed a breach of privacy to occur.Which of the following is not one of the considerations?

A)Is the measure causing the breach demonstrably necessary to meet a specific need?
B)Is the breach likely to be effective in meeting a specific need?
C)Is the loss of privacy proportional to the benefit gained?
D)Is there a less privacy-invasive way of achieving the same end?
E)Did the firm monetarily benefit from the breach of privacy?

Question 18

You are an employee who believes that your privacy rights have been violated.Which of the following is not true?

A)You may be entitled to privacy protection under provincial privacy legislation.
B)Your employer may have business requirements that permit the breach of privacy.
C)The violation may be justified if considered reasonable.
D)You are entitled to compensation for any harm you believe has been caused.
E)The firm will need to demonstrate that the breach was reasonable.

Question 19

Joan is being bombarded by charitable appeals from across the country.She discovers that a company has sent out her name to other charities.Upon what basis would her complaint to the Privacy Commissioner be based?

A)The obligation not to disclose personal information to other charities without consent.
B)The obligation to maintain accurate information.
C)The obligation to identify an individual to be responsible to protect personal information.
D)The obligation to develop policies regarding the protection of personal information.
E)The obligation to destroy personal information.

Question 20

Your company would like to send commercial electronic information to a customer.They may send the information on a non-temporary basis when

A)the recipient has agreed to your request.
B)a pre-existing relationship with the recipient exists.
C)when recipients have disclosed their email addresses to the sender.
D)recipients have publicly made their email addresses available.
E)the information is not factual.

Question 21

The unsubscribe function for commercial electronic messages must be easy for the recipient to use and have no cost.

Question 22

A commercial electronic message does not need to contain the sender's contact information.

Question 23

When a breach of employees' privacy does occur,the onus will be on the organization experiencing the breach to show that the breach was reasonable under the circumstances.

Question 24

You have been assigned the responsibility for establishing the protection of personal information in your firm according to the PIPEDA.What are the key principles and obligations that your firm must comply with?

Question 25

The PIPEDA also applies to relationships of employment for federally regulated employees.

Question 26

Implied consent may arise when a business has a pre-existing relationship with a recipient.

Question 27

Harvesting email addresses or using harvested addresses is now a violation of the law.

Question 28

A breach of privacy was not recognized by recent case law in Ontario as a tort.

Question 29

Anti-spam legislation focuses on messages sent to encourage participation in commercial activity that has an expectation of profit.

Question 30

The fine for violating Canada's Anti-Spam Legislation is $1 million for individuals per infraction.

Question 31

You have discovered that your firm may have misused personal information from a client.You know that you are obligated to notify the Privacy Commissioner for situations that involve a material breach of security around personal information,and to notify the individuals concerned when the breach of security around their information creates a real risk of significant harm.What types of harm might be trigger the obligation to report the breach?

Question 32

The PIPEDA requires businesses to identify an individual within the organization who is responsible for developing and implementing the company's policies regarding personal information.