Protecting Workplace Information Course: Sharing information safely: email, talk and AI tools

1. Question 1 of 16

   Before you share confidential information with a coworker, what is the key question?

   • ADoes this coworker work in the same building?
   • BHas this coworker asked for it more than once?
   • CIs this coworker more senior than me?
   • DDoes this person need it to do their job?
   Show answer

   Answer: D. Does this person need it to do their job?

   Need-to-know is the test for sharing: people get only the information they need for their work.

2. Question 2 of 16

   Under PIPEDA, when may personal information be used for a new purpose it was not collected for?

   • AOnce one year has passed since it was first collected from them
   • BWhenever the new purpose is useful to the business
   • CWhenever a manager approves the new use
   • DWith the person's consent, unless the law requires otherwise
   Show answer

   Answer: D. With the person's consent, unless the law requires otherwise

   Information may be used only for the purposes it was collected for; a new purpose needs fresh consent unless the law requires it.

3. Question 3 of 16

   A contractor needs a site incident report to repair a broken gate. The report names an injured visitor and gives her phone number. What should you do?

   • ABlack out the visitor's details before you send it
   • BSend it and ask the contractor not to read that part
   • CRead the whole report to the contractor by phone
   • DSend the full report so nothing is missing
   Show answer

   Answer: A. Black out the visitor's details before you send it

   When giving copies to others, remove or block out personal information that is not relevant to the task.

4. Question 4 of 16

   You type "Sam" and your email program fills in "Sam Lee". There are two people named Sam in the directory. What is the best habit?

   • AAdd both people named Sam to be safe
   • BCheck each address before you press Send
   • CSend it and correct the address later if needed
   • DTrust autocomplete, because it learns over time
   Show answer

   Answer: B. Check each address before you press Send

   Misdirected email is a common unauthorized disclosure; checking each recipient prevents it.

5. Question 5 of 16

   You must send one notice to 150 members of the public. How should you keep their email addresses private?

   • APut them in To and ask people not to reply all
   • BSplit them into three groups in the To field
   • CPut all the addresses in the CC field
   • DUse BCC, or a mailing tool that hides addresses
   Show answer

   Answer: D. Use BCC, or a mailing tool that hides addresses

   BCC hides recipients from each other; the Saskatchewan Commissioner found that sending without it exposed personal information.

6. Question 6 of 16

   In the 2022 Saskatchewan case, a group email was sent without BCC, so every recipient could see the others' personal email addresses. What did the Commissioner find?

   • AThe addresses were personal information, so this was a breach
   • BThe addresses were public because people had given them out freely
   • CIt would only be a breach with more than 500 addresses
   • DThe addresses were business contact information
   Show answer

   Answer: A. The addresses were personal information, so this was a breach

   The Commissioner found the personal email addresses were personal information, so showing them to all recipients was a privacy breach.

7. Question 7 of 16

   What should you check before you send an email with an attachment?

   • ACheck that the file is not too large to send
   • BRename the file so it ends with the word final
   • COpen the file to confirm it is the right one
   • DCompress the file so it uploads faster
   Show answer

   Answer: C. Open the file to confirm it is the right one

   Sending the wrong file is a transmission error, and misdirected email is one of the most common privacy breaches; open the file and check it first.

8. Question 8 of 16

   You are asked to forward a long email thread to a new supplier. What is the main privacy risk?

   • AOlder messages may hold details the supplier should not see
   • BLong threads are always sent to the junk folder
   • CForwarded threads cannot be opened by anyone outside the company
   • DThe supplier will see your password in the thread
   Show answer

   Answer: A. Older messages may hold details the supplier should not see

   Read the whole thread first; earlier messages may contain information outside the supplier's need-to-know.

9. Question 9 of 16

   A coworker suggests emailing client files to her personal email so she can finish them at home. What do privacy commissioners advise?

   • ADo not use personal email to move work records
   • BIt is fine if the files have a password
   • CIt is fine if her manager is copied on the email
   • DIt is fine if she deletes the files afterward
   Show answer

   Answer: A. Do not use personal email to move work records

   BC's Privacy Commissioner advises against using personal email to transfer work records that hold personal information.

10. Question 10 of 16

    Read the situation. What should you do first?

    You meant to email a spreadsheet of 300 customers' names and phone numbers to Jamie Patel in your accounts team. Autocomplete chose Jamie Patil, an outside supplier. You notice two minutes after sending.

    • ASend another email asking the supplier to ignore the first one
    • BWait to see whether the outside contact replies
    • CReport it right away to your supervisor or privacy officer
    • DDelete the message from your Sent folder
    Show answer

    Answer: C. Report it right away to your supervisor or privacy officer

    Report a misdirected email at once so containment can start, such as asking the recipient to delete or return it.

11. Question 11 of 16

    Personal information was emailed to the wrong person by mistake. Which containment step does the OPC suggest?

    • AAsk them to print a copy and mail it back to you
    • BAsk them to delete it, return it securely or hold it
    • CSend the file again with a note that says confidential
    • DLeave them alone so they do not notice the mistake
    Show answer

    Answer: B. Ask them to delete it, return it securely or hold it

    The OPC's containment tips include asking a wrong recipient to delete the information, return it securely or hold it for collection.

12. Question 12 of 16

    You and a coworker are in a crowded elevator. She starts talking about a customer's billing complaint and uses the customer's full name. What is best?

    • AKeep talking, since the visitors do not know the customer
    • BKeep talking but use only the first name
    • CWait until you are somewhere private to discuss it
    • DKeep talking but lower your voices
    Show answer

    Answer: C. Wait until you are somewhere private to discuss it

    Sensitive information should not be discussed in public places or where people without a need-to-know can hear.

13. Question 13 of 16

    You are on a work call in a busy café. What does the Canadian Centre for Cyber Security advise?

    • ASpeak quickly so others cannot follow
    • BOnly worry if you are reading a password aloud
    • CUse speakerphone so the sound is clearer
    • DBe aware of anyone who might be listening
    Show answer

    Answer: D. Be aware of anyone who might be listening

    Cyber Centre remote work tips say to be aware of anyone who might be listening to your phone call.

14. Question 14 of 16

    What does Government of Canada guidance say about public generative AI tools?

    • ANever put protected, classified or personal information into them
    • BPersonal information is fine for drafts that will not be published
    • CPersonal information is fine if you remove the last names
    • DPersonal information is fine if you delete the chat afterward
    Show answer

    Answer: A. Never put protected, classified or personal information into them

    The guidance says never to input protected, classified or personal information into public generative AI tools, and to use them only with unclassified information.

15. Question 15 of 16

    Read the situation. Why is this a privacy problem?

    A coworker gets a long complaint from a customer. To save time, she pastes the full complaint into a free public AI chatbot and asks it to write a reply. The complaint includes the customer's name, home address and account number.

    • AThe reply might be written in the wrong language
    • BThe data may be stored, shared or used to train the tool
    • CThe chatbot cannot read account numbers correctly
    • DFree public chatbots always delete each chat as soon as it ends
    Show answer

    Answer: B. The data may be stored, shared or used to train the tool

    Get Cyber Safe warns that once you give data to an AI tool you lose control over where it goes; it may be stored, shared or used for training.

16. Question 16 of 16

    You need to share a payroll summary with two managers on the company's approved shared drive. Which method best follows need-to-know?

    • AEmail it to the department list and ask others to ignore it
    • BShare it with the two managers by name
    • CPost a link to it in the team chat channel
    • DSave it where the whole department can open it
    Show answer

    Answer: B. Share it with the two managers by name

    Sharing only with the named people who need the file limits access to need-to-know.

Keyboard: 1–4 to answer, Enter for the next question.