Protecting Workplace Information Course: Sharing information safely: email, talk and AI tools

1. Vraag 1 van 16

   Before you share confidential information with a coworker, what is the key question?

   • ADoes this coworker work in the same building?
   • BHas this coworker asked for it more than once?
   • CIs this coworker more senior than me?
   • DDoes this person need it to do their job?
   Toon antwoord

   Antwoord: D. Does this person need it to do their job?

   Need-to-know is the test for sharing: people get only the information they need for their work.

2. Vraag 2 van 16

   Under PIPEDA, when may personal information be used for a new purpose it was not collected for?

   • AOnce one year has passed since it was first collected from them
   • BWhenever the new purpose is useful to the business
   • CWhenever a manager approves the new use
   • DWith the person's consent, unless the law requires otherwise
   Toon antwoord

   Antwoord: D. With the person's consent, unless the law requires otherwise

   Information may be used only for the purposes it was collected for; a new purpose needs fresh consent unless the law requires it.

3. Vraag 3 van 16

   A contractor needs a site incident report to repair a broken gate. The report names an injured visitor and gives her phone number. What should you do?

   • ABlack out the visitor's details before you send it
   • BSend it and ask the contractor not to read that part
   • CRead the whole report to the contractor by phone
   • DSend the full report so nothing is missing
   Toon antwoord

   Antwoord: A. Black out the visitor's details before you send it

   When giving copies to others, remove or block out personal information that is not relevant to the task.

4. Vraag 4 van 16

   You type "Sam" and your email program fills in "Sam Lee". There are two people named Sam in the directory. What is the best habit?

   • AAdd both people named Sam to be safe
   • BCheck each address before you press Send
   • CSend it and correct the address later if needed
   • DTrust autocomplete, because it learns over time
   Toon antwoord

   Antwoord: B. Check each address before you press Send

   Misdirected email is a common unauthorized disclosure; checking each recipient prevents it.

5. Vraag 5 van 16

   You must send one notice to 150 members of the public. How should you keep their email addresses private?

   • APut them in To and ask people not to reply all
   • BSplit them into three groups in the To field
   • CPut all the addresses in the CC field
   • DUse BCC, or a mailing tool that hides addresses
   Toon antwoord

   Antwoord: D. Use BCC, or a mailing tool that hides addresses

   BCC hides recipients from each other; the Saskatchewan Commissioner found that sending without it exposed personal information.

6. Vraag 6 van 16

   In the 2022 Saskatchewan case, a group email was sent without BCC, so every recipient could see the others' personal email addresses. What did the Commissioner find?

   • AThe addresses were personal information, so this was a breach
   • BThe addresses were public because people had given them out freely
   • CIt would only be a breach with more than 500 addresses
   • DThe addresses were business contact information
   Toon antwoord

   Antwoord: A. The addresses were personal information, so this was a breach

   The Commissioner found the personal email addresses were personal information, so showing them to all recipients was a privacy breach.

7. Vraag 7 van 16

   What should you check before you send an email with an attachment?

   • ACheck that the file is not too large to send
   • BRename the file so it ends with the word final
   • COpen the file to confirm it is the right one
   • DCompress the file so it uploads faster
   Toon antwoord

   Antwoord: C. Open the file to confirm it is the right one

   Sending the wrong file is a transmission error, and misdirected email is one of the most common privacy breaches; open the file and check it first.

8. Vraag 8 van 16

   You are asked to forward a long email thread to a new supplier. What is the main privacy risk?

   • AOlder messages may hold details the supplier should not see
   • BLong threads are always sent to the junk folder
   • CForwarded threads cannot be opened by anyone outside the company
   • DThe supplier will see your password in the thread
   Toon antwoord

   Antwoord: A. Older messages may hold details the supplier should not see

   Read the whole thread first; earlier messages may contain information outside the supplier's need-to-know.

9. Vraag 9 van 16

   A coworker suggests emailing client files to her personal email so she can finish them at home. What do privacy commissioners advise?

   • ADo not use personal email to move work records
   • BIt is fine if the files have a password
   • CIt is fine if her manager is copied on the email
   • DIt is fine if she deletes the files afterward
   Toon antwoord

   Antwoord: A. Do not use personal email to move work records

   BC's Privacy Commissioner advises against using personal email to transfer work records that hold personal information.

10. Vraag 10 van 16

    Read the situation. What should you do first?

    You meant to email a spreadsheet of 300 customers' names and phone numbers to Jamie Patel in your accounts team. Autocomplete chose Jamie Patil, an outside supplier. You notice two minutes after sending.

    • ASend another email asking the supplier to ignore the first one
    • BWait to see whether the outside contact replies
    • CReport it right away to your supervisor or privacy officer
    • DDelete the message from your Sent folder
    Toon antwoord

    Antwoord: C. Report it right away to your supervisor or privacy officer

    Report a misdirected email at once so containment can start, such as asking the recipient to delete or return it.

11. Vraag 11 van 16

    Personal information was emailed to the wrong person by mistake. Which containment step does the OPC suggest?

    • AAsk them to print a copy and mail it back to you
    • BAsk them to delete it, return it securely or hold it
    • CSend the file again with a note that says confidential
    • DLeave them alone so they do not notice the mistake
    Toon antwoord

    Antwoord: B. Ask them to delete it, return it securely or hold it

    The OPC's containment tips include asking a wrong recipient to delete the information, return it securely or hold it for collection.

12. Vraag 12 van 16

    You and a coworker are in a crowded elevator. She starts talking about a customer's billing complaint and uses the customer's full name. What is best?

    • AKeep talking, since the visitors do not know the customer
    • BKeep talking but use only the first name
    • CWait until you are somewhere private to discuss it
    • DKeep talking but lower your voices
    Toon antwoord

    Antwoord: C. Wait until you are somewhere private to discuss it

    Sensitive information should not be discussed in public places or where people without a need-to-know can hear.

13. Vraag 13 van 16

    You are on a work call in a busy café. What does the Canadian Centre for Cyber Security advise?

    • ASpeak quickly so others cannot follow
    • BOnly worry if you are reading a password aloud
    • CUse speakerphone so the sound is clearer
    • DBe aware of anyone who might be listening
    Toon antwoord

    Antwoord: D. Be aware of anyone who might be listening

    Cyber Centre remote work tips say to be aware of anyone who might be listening to your phone call.

14. Vraag 14 van 16

    What does Government of Canada guidance say about public generative AI tools?

    • ANever put protected, classified or personal information into them
    • BPersonal information is fine for drafts that will not be published
    • CPersonal information is fine if you remove the last names
    • DPersonal information is fine if you delete the chat afterward
    Toon antwoord

    Antwoord: A. Never put protected, classified or personal information into them

    The guidance says never to input protected, classified or personal information into public generative AI tools, and to use them only with unclassified information.

15. Vraag 15 van 16

    Read the situation. Why is this a privacy problem?

    A coworker gets a long complaint from a customer. To save time, she pastes the full complaint into a free public AI chatbot and asks it to write a reply. The complaint includes the customer's name, home address and account number.

    • AThe reply might be written in the wrong language
    • BThe data may be stored, shared or used to train the tool
    • CThe chatbot cannot read account numbers correctly
    • DFree public chatbots always delete each chat as soon as it ends
    Toon antwoord

    Antwoord: B. The data may be stored, shared or used to train the tool

    Get Cyber Safe warns that once you give data to an AI tool you lose control over where it goes; it may be stored, shared or used for training.

16. Vraag 16 van 16

    You need to share a payroll summary with two managers on the company's approved shared drive. Which method best follows need-to-know?

    • AEmail it to the department list and ask others to ignore it
    • BShare it with the two managers by name
    • CPost a link to it in the team chat channel
    • DSave it where the whole department can open it
    Toon antwoord

    Antwoord: B. Share it with the two managers by name

    Sharing only with the named people who need the file limits access to need-to-know.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.