Protecting Workplace Information Course: Privacy breaches: spot, contain and report

1. السؤال 1 من 18

   Under PIPEDA, which three events count as a breach of security safeguards?

   • AUpdating, correcting or deleting personal information
   • BLoss of, unauthorized access to, or unauthorized disclosure of personal information
   • CPrinting, scanning or faxing personal information
   • DCollecting, storing or backing up personal information without telling anyone first
   أظهر الإجابة

   الإجابة: B. Loss of, unauthorized access to, or unauthorized disclosure of personal information

   PIPEDA defines a breach of security safeguards as the loss of, unauthorized access to or unauthorized disclosure of personal information.

2. السؤال 2 من 18

   A box of employee files goes missing during an office move. What type of breach is this?

   • ALoss
   • BIt is not a breach
   • CUnauthorized disclosure
   • DUnauthorized access
   أظهر الإجابة

   الإجابة: A. Loss

   Information that goes missing, including during an office move, is a loss.

3. السؤال 3 من 18

   A fax with patient information goes to the wrong number. What type of breach is this?

   • AUnauthorized access
   • BIt is not a breach, because it was an accident
   • CUnauthorized disclosure
   • DLoss
   أظهر الإجابة

   الإجابة: C. Unauthorized disclosure

   Misdirected email, fax or mail is unauthorized disclosure.

4. السؤال 4 من 18

   A receptionist reads her ex-partner's file in the clinic's system just to see it. What type of breach is this?

   • AUnauthorized access
   • BUnauthorized disclosure
   • CLoss
   • DIt is not a breach, since she told no one
   أظهر الإجابة

   الإجابة: A. Unauthorized access

   An employee viewing records without permission is unauthorized access, even if the information is not shared.

5. السؤال 5 من 18

   What is employee snooping?

   • AReviewing your own pay records online
   • BLooking at personal information without authorization or a business purpose
   • CReading the company's privacy policy
   • DChecking a coworker's report for spelling and grammar errors before it goes out
   أظهر الإجابة

   الإجابة: B. Looking at personal information without authorization or a business purpose

   The OPC defines snooping as accessing personal information without authorization and without a legitimate business purpose.

6. السؤال 6 من 18

   Which practice helps employers detect and deter employee snooping?

   • AKeeping access logs and reviewing them regularly
   • BTurning off logs to save storage space
   • CLetting all staff share one login
   • DGiving every employee access to all files so nobody needs to ask
   أظهر الإجابة

   الإجابة: A. Keeping access logs and reviewing them regularly

   Access logs and regular audits support investigations and deter snooping when employees know they exist.

7. السؤال 7 من 18

   On Monday morning you find a cabinet of personnel files unlocked and open. It was left that way overnight. What should you do first?

   • ACount the files yourself before telling anyone
   • BAsk coworkers one by one who left the cabinet open last night
   • CReport it right away to your supervisor or privacy officer
   • DLock it and say nothing, since nothing seems missing
   أظهر الإجابة

   الإجابة: C. Report it right away to your supervisor or privacy officer

   Report possible breaches at once so the organization can contain and assess them; do not investigate on your own.

8. السؤال 8 من 18

   A breach was caused by a hacked user account. Which containment step does the OPC list?

   • ADelete the account's activity logs
   • BReset the affected passwords right away
   • CEmail all customers before learning what happened
   • DWait for police before changing anything
   أظهر الإجابة

   الإجابة: B. Reset the affected passwords right away

   The OPC's containment tips include resetting affected passwords immediately when a hacked account caused the breach.

9. السؤال 9 من 18

   A laptop with client records is lost. Which containment step does the OPC suggest, if possible?

   • AWait a month in case it turns up
   • BBuy the same model to replace it
   • CChange the company's email signature
   • DWipe its memory remotely
   أظهر الإجابة

   الإجابة: D. Wipe its memory remotely

   If a laptop is lost or stolen, the OPC suggests wiping its memory remotely if possible.

10. السؤال 10 من 18

    Why should evidence be preserved after a breach?

    • AIt replaces the need to notify anyone
    • BIt is needed before any staff members are allowed to go home
    • CIt helps find the cause and prevent future breaches
    • DIt lets the company skip containment
    أظهر الإجابة

    الإجابة: C. It helps find the cause and prevent future breaches

    The OPC says preserving evidence helps identify the cause and prevent future breaches.

11. السؤال 11 من 18

    Under PIPEDA, what test decides whether a breach must be reported to the OPC?

    • AWhether the attacker asked for money
    • BWhether it creates a real risk of significant harm
    • CWhether the news media found out
    • DWhether more than 500 people are affected by the breach
    أظهر الإجابة

    الإجابة: B. Whether it creates a real risk of significant harm

    Organizations must report and notify when it is reasonable to believe a breach creates a real risk of significant harm.

12. السؤال 12 من 18

    A breach could cause a person to lose their job. Does that count as significant harm under PIPEDA?

    • ANo, only money that was actually lost counts
    • BNo, only bodily harm counts
    • CYes, loss of employment is included
    • DOnly if the loss is over $1,000
    أظهر الإجابة

    الإجابة: C. Yes, loss of employment is included

    Significant harm includes loss of employment, along with financial loss, identity theft, humiliation and other harms.

13. السؤال 13 من 18

    Which two main factors decide whether a breach creates a real risk of significant harm?

    • AWhich department caused it and how busy it was
    • BHow sensitive the information is and how likely misuse is
    • CHow old the information is and who first collected it
    • DHow many pages were lost and how much the files weigh in total
    أظهر الإجابة

    الإجابة: B. How sensitive the information is and how likely misuse is

    The assessment looks at the sensitivity of the information and the probability it will be misused.

14. السؤال 14 من 18

    A breach affects only one customer. Does the real risk of significant harm test still apply?

    • AOnly if the customer asks for it to apply
    • BNo, single-person breaches are handled by police
    • CYes, the same test applies to one person or 1,000
    • DNo, the test only applies when 100 or more people are affected
    أظهر الإجابة

    الإجابة: C. Yes, the same test applies to one person or 1,000

    The OPC notes the requirement applies whether a breach affects one person or 1,000.

15. السؤال 15 من 18

    When must the people affected by a reportable breach be notified under PIPEDA?

    • AWithin exactly 72 hours of the breach
    • BAs soon as feasible once the risk is found
    • COnly after the police investigation has fully ended
    • DWithin one year of the breach
    أظهر الإجابة

    الإجابة: B. As soon as feasible once the risk is found

    Individuals must be notified as soon as feasible after the organization determines the breach poses a real risk of significant harm.

16. السؤال 16 من 18

    When may an organization use indirect notice, such as a public announcement, instead of contacting people directly?

    • AWhen direct notice would cause more harm or hardship, or contacts are unknown
    • BWhenever more than 10 people are affected
    • CWhenever a public announcement would be cheaper than mailing letters to everyone
    • DWhenever the breach happened over a weekend
    أظهر الإجابة

    الإجابة: A. When direct notice would cause more harm or hardship, or contacts are unknown

    Indirect notice is allowed only when direct notice would cause further harm or undue hardship, or contact information is unavailable.

17. السؤال 17 من 18

    A breach does not create a real risk of significant harm. What must a PIPEDA organization still do?

    • AKeep a record of it for two years
    • BPost a notice about it on its website
    • CNothing, since it does not need to be reported
    • DReport it to the OPC within 24 hours
    أظهر الإجابة

    الإجابة: A. Keep a record of it for two years

    Records must be kept of every breach of security safeguards, whether or not it creates a real risk of significant harm, for two years.

18. السؤال 18 من 18

    Under Alberta's PIPA, when must an organization notify Alberta's Privacy Commissioner of a breach with a real risk of significant harm?

    • AOnly if the people affected complain
    • BWithin 90 days, once the cause is fixed
    • CWithout unreasonable delay, even before its investigation ends
    • DOnly after its own internal investigation is complete and signed off
    أظهر الإجابة

    الإجابة: C. Without unreasonable delay, even before its investigation ends

    Alberta's OIPC says notice must be given without unreasonable delay and should not wait for the internal investigation to finish.

لوحة المفاتيح: 1–4 للإجابة، وEnter للسؤال التالي.