Protecting Workplace Information Course: Printing, storage, retention and disposal

1. Vraag 1 van 16

   You are going to lunch and there are papers with client details on your desk. What should you do?

   • ATurn the papers face down on the desk
   • BAsk the person at the next desk to watch them
   • CLock them in a drawer and lock your screen
   • DLeave them, since you will only be gone a short time
   Toon antwoord

   Antwoord: C. Lock them in a drawer and lock your screen

   Sensitive information should not be left unprotected when you are away from your desk.

2. Vraag 2 van 16

   You print a list of employee home addresses on a shared printer. What should you do?

   • ACollect it at the end of the day with other printouts
   • BAsk anyone walking by to bring it to your desk
   • CPrint a second copy in case the first one goes missing
   • DCollect it right away or use the secure print release
   Toon antwoord

   Antwoord: D. Collect it right away or use the secure print release

   Sensitive printouts should never be left at the printer; collect them at once.

3. Vraag 3 van 16

   What should happen to cabinets holding sensitive files at the end of the day?

   • AThey should be locked
   • BThey should be labelled with their contents
   • CThey should be left open for the cleaners
   • DThey should be moved to the hallway
   Toon antwoord

   Antwoord: A. They should be locked

   Cabinets and other storage for sensitive information should be locked at the end of the day.

4. Vraag 4 van 16

   Under PIPEDA, how long should personal information be kept?

   • AForever, in case it turns out to be useful at some later date
   • BOnly as long as needed for the purposes it was collected for
   • CExactly seven years for every type of record
   • DUntil the storage system runs out of space
   Toon antwoord

   Antwoord: B. Only as long as needed for the purposes it was collected for

   The limiting use, disclosure and retention principle says to keep personal information only as long as needed for its purposes.

5. Vraag 5 van 16

   Why is it risky to keep old personal information "just in case"?

   • AThe more you hold, the bigger the harm if there is a breach
   • BOld files make the shared printer run more slowly
   • COld files automatically become public after a few years
   • DThe law requires deleting all records after exactly one year
   Toon antwoord

   Antwoord: A. The more you hold, the bigger the harm if there is a breach

   The OPC notes that keeping large volumes of information indefinitely increases the risk and consequences of a breach.

6. Vraag 6 van 16

   What does a retention schedule set for each type of record?

   • AA minimum and a maximum retention period
   • BA minimum period only
   • CA colour code for its folder
   • DThe name of the person who first created it
   Toon antwoord

   Antwoord: A. A minimum and a maximum retention period

   The OPC recommends setting both a minimum and a maximum retention period for each category of information.

7. Vraag 7 van 16

   Personal information was used to turn down a job applicant. How long should it be kept?

   • ALong enough for the applicant to see and challenge it
   • BIt should be kept forever in case of future job openings
   • CIt should be kept only until the applicant is told
   • DIt should be deleted on the day of the decision
   Toon antwoord

   Antwoord: A. Long enough for the applicant to see and challenge it

   Information used to make a decision about a person should be kept long enough for them to access it and challenge the decision.

8. Vraag 8 van 16

   Information about customers is now kept only for statistics. What does the OPC suggest?

   • AEmail the data to the statistics team
   • BMake it anonymous using effective techniques
   • CPrint the data and store it in boxes
   • DKeep the names but move them to a hidden tab
   Toon antwoord

   Antwoord: B. Make it anonymous using effective techniques

   If information is kept only for statistics, effective techniques should be used to anonymize it.

9. Vraag 9 van 16

   What is the right way to throw out paper records that hold personal information?

   • ATear each page in half
   • BPut them in the garbage in a sealed bag
   • CShred them securely
   • DPut them in the blue recycling bin
   Toon antwoord

   Antwoord: C. Shred them securely

   The OPC advises disposing of paper files securely, for example by shredding, so the personal information cannot be read again.

10. Vraag 10 van 16

    Your office is getting rid of an old photocopier. What privacy risk must be handled first?

    • AOnly the glass needs cleaning to remove any marks
    • BIts toner can be read to rebuild past copies
    • CThere is no risk, because copiers do not store data
    • DIts hard drive may store copies and must be wiped
    Toon antwoord

    Antwoord: D. Its hard drive may store copies and must be wiped

    Copiers and printers can store data on a hard drive, so the OPC says to fully delete personal information before disposing of devices such as photocopiers.

11. Vraag 11 van 16

    Degaussing uses a strong magnetic field to erase data. On which media does it NOT work?

    • ACDs and DVDs
    • BFloppy disks
    • CMagnetic hard drives
    • DMagnetic tapes
    Toon antwoord

    Antwoord: A. CDs and DVDs

    Degaussing works on magnetic media only; the OPC notes it does not work on CDs or DVDs.

12. Vraag 12 van 16

    You delete a file of expired customer records from the shared drive. What else must be dealt with?

    • AAny copies and backups of the file
    • BOnly the file's name in the drive index
    • COnly the printer's settings
    • DNothing else, once the main file is deleted
    Toon antwoord

    Antwoord: A. Any copies and backups of the file

    Disposal must cover all associated copies and backup files, not just the main file.

13. Vraag 13 van 16

    Your office is replacing ten old laptops. What should happen to them?

    • ADrop them off at a public recycling depot near the office
    • BGive them to staff to take home
    • CSell them online after emptying the desktop
    • DSend them to the person who arranges data destruction
    Toon antwoord

    Antwoord: D. Send them to the person who arranges data destruction

    The OPC suggests routing electronic devices to a designated person who arranges for data destruction.

14. Vraag 14 van 16

    Old hard drives will be sold and reused by another company. Which approach does the OPC suggest?

    • AJust remove the company labels from the drives
    • BUse a stronger method, since they will leave your control
    • CA quick delete is enough, since the buyer will reuse them
    • DDo nothing, since the buyer becomes responsible
    Toon antwoord

    Antwoord: B. Use a stronger method, since they will leave your control

    When media will be reused by others outside your control, a stronger sanitization method is needed.

15. Vraag 15 van 16

    Your company hires a shredding company. Who is responsible for the information until it is destroyed?

    • AYour company, so it should check and monitor the shredder
    • BNobody, once the boxes leave the building
    • CThe people whose information is in the boxes
    • DOnly the shredding company, from the moment it picks up the boxes
    Toon antwoord

    Antwoord: A. Your company, so it should check and monitor the shredder

    Organizations remain responsible for information sent to a third party and should verify the provider, use a contract and do spot-checks.

16. Vraag 16 van 16

    Sealed boxes of records are waiting for the shredding company. Where should they be kept?

    • AIn the parking lot so pickup is quicker
    • BIn a secure area with restricted access
    • CIn a recycling room shared with other tenants
    • DIn the hallway near the loading door
    Toon antwoord

    Antwoord: B. In a secure area with restricted access

    Information awaiting disposal should be stored in a secure, access-restricted area.

Toetsenbord: 1–4 om te antwoorden, Enter voor de volgende vraag.