Protecting Workplace Information Course: Printing, storage, retention and disposal

1. Question 1 of 16

   You are going to lunch and there are papers with client details on your desk. What should you do?

   • ATurn the papers face down on the desk
   • BAsk the person at the next desk to watch them
   • CLock them in a drawer and lock your screen
   • DLeave them, since you will only be gone a short time
   Show answer

   Answer: C. Lock them in a drawer and lock your screen

   Sensitive information should not be left unprotected when you are away from your desk.

2. Question 2 of 16

   You print a list of employee home addresses on a shared printer. What should you do?

   • ACollect it at the end of the day with other printouts
   • BAsk anyone walking by to bring it to your desk
   • CPrint a second copy in case the first one goes missing
   • DCollect it right away or use the secure print release
   Show answer

   Answer: D. Collect it right away or use the secure print release

   Sensitive printouts should never be left at the printer; collect them at once.

3. Question 3 of 16

   What should happen to cabinets holding sensitive files at the end of the day?

   • AThey should be locked
   • BThey should be labelled with their contents
   • CThey should be left open for the cleaners
   • DThey should be moved to the hallway
   Show answer

   Answer: A. They should be locked

   Cabinets and other storage for sensitive information should be locked at the end of the day.

4. Question 4 of 16

   Under PIPEDA, how long should personal information be kept?

   • AForever, in case it turns out to be useful at some later date
   • BOnly as long as needed for the purposes it was collected for
   • CExactly seven years for every type of record
   • DUntil the storage system runs out of space
   Show answer

   Answer: B. Only as long as needed for the purposes it was collected for

   The limiting use, disclosure and retention principle says to keep personal information only as long as needed for its purposes.

5. Question 5 of 16

   Why is it risky to keep old personal information "just in case"?

   • AThe more you hold, the bigger the harm if there is a breach
   • BOld files make the shared printer run more slowly
   • COld files automatically become public after a few years
   • DThe law requires deleting all records after exactly one year
   Show answer

   Answer: A. The more you hold, the bigger the harm if there is a breach

   The OPC notes that keeping large volumes of information indefinitely increases the risk and consequences of a breach.

6. Question 6 of 16

   What does a retention schedule set for each type of record?

   • AA minimum and a maximum retention period
   • BA minimum period only
   • CA colour code for its folder
   • DThe name of the person who first created it
   Show answer

   Answer: A. A minimum and a maximum retention period

   The OPC recommends setting both a minimum and a maximum retention period for each category of information.

7. Question 7 of 16

   Personal information was used to turn down a job applicant. How long should it be kept?

   • ALong enough for the applicant to see and challenge it
   • BIt should be kept forever in case of future job openings
   • CIt should be kept only until the applicant is told
   • DIt should be deleted on the day of the decision
   Show answer

   Answer: A. Long enough for the applicant to see and challenge it

   Information used to make a decision about a person should be kept long enough for them to access it and challenge the decision.

8. Question 8 of 16

   Information about customers is now kept only for statistics. What does the OPC suggest?

   • AEmail the data to the statistics team
   • BMake it anonymous using effective techniques
   • CPrint the data and store it in boxes
   • DKeep the names but move them to a hidden tab
   Show answer

   Answer: B. Make it anonymous using effective techniques

   If information is kept only for statistics, effective techniques should be used to anonymize it.

9. Question 9 of 16

   What is the right way to throw out paper records that hold personal information?

   • ATear each page in half
   • BPut them in the garbage in a sealed bag
   • CShred them securely
   • DPut them in the blue recycling bin
   Show answer

   Answer: C. Shred them securely

   The OPC advises disposing of paper files securely, for example by shredding, so the personal information cannot be read again.

10. Question 10 of 16

    Your office is getting rid of an old photocopier. What privacy risk must be handled first?

    • AOnly the glass needs cleaning to remove any marks
    • BIts toner can be read to rebuild past copies
    • CThere is no risk, because copiers do not store data
    • DIts hard drive may store copies and must be wiped
    Show answer

    Answer: D. Its hard drive may store copies and must be wiped

    Copiers and printers can store data on a hard drive, so the OPC says to fully delete personal information before disposing of devices such as photocopiers.

11. Question 11 of 16

    Degaussing uses a strong magnetic field to erase data. On which media does it NOT work?

    • ACDs and DVDs
    • BFloppy disks
    • CMagnetic hard drives
    • DMagnetic tapes
    Show answer

    Answer: A. CDs and DVDs

    Degaussing works on magnetic media only; the OPC notes it does not work on CDs or DVDs.

12. Question 12 of 16

    You delete a file of expired customer records from the shared drive. What else must be dealt with?

    • AAny copies and backups of the file
    • BOnly the file's name in the drive index
    • COnly the printer's settings
    • DNothing else, once the main file is deleted
    Show answer

    Answer: A. Any copies and backups of the file

    Disposal must cover all associated copies and backup files, not just the main file.

13. Question 13 of 16

    Your office is replacing ten old laptops. What should happen to them?

    • ADrop them off at a public recycling depot near the office
    • BGive them to staff to take home
    • CSell them online after emptying the desktop
    • DSend them to the person who arranges data destruction
    Show answer

    Answer: D. Send them to the person who arranges data destruction

    The OPC suggests routing electronic devices to a designated person who arranges for data destruction.

14. Question 14 of 16

    Old hard drives will be sold and reused by another company. Which approach does the OPC suggest?

    • AJust remove the company labels from the drives
    • BUse a stronger method, since they will leave your control
    • CA quick delete is enough, since the buyer will reuse them
    • DDo nothing, since the buyer becomes responsible
    Show answer

    Answer: B. Use a stronger method, since they will leave your control

    When media will be reused by others outside your control, a stronger sanitization method is needed.

15. Question 15 of 16

    Your company hires a shredding company. Who is responsible for the information until it is destroyed?

    • AYour company, so it should check and monitor the shredder
    • BNobody, once the boxes leave the building
    • CThe people whose information is in the boxes
    • DOnly the shredding company, from the moment it picks up the boxes
    Show answer

    Answer: A. Your company, so it should check and monitor the shredder

    Organizations remain responsible for information sent to a third party and should verify the provider, use a contract and do spot-checks.

16. Question 16 of 16

    Sealed boxes of records are waiting for the shredding company. Where should they be kept?

    • AIn the parking lot so pickup is quicker
    • BIn a secure area with restricted access
    • CIn a recycling room shared with other tenants
    • DIn the hallway near the loading door
    Show answer

    Answer: B. In a secure area with restricted access

    Information awaiting disposal should be stored in a secure, access-restricted area.

Keyboard: 1–4 to answer, Enter for the next question.