![Page 1: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/1.jpg)
A Principled Approach:
Lessons on PIPA and the Privacy Principles
Privacy, Compliance & Training Branch
Corporate Information and Records Management Office
Ministry of Citizens’ Services
![Page 2: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/2.jpg)
• Who we are
• Oversight – the role of the OIPC
• What is Privacy? Personal Information?
• The 10 Privacy Principles
• Overview of PIPA
• Consent – how it works in practice
• Resources
What we’ll talk about today …
![Page 3: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/3.jpg)
![Page 4: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/4.jpg)
Who are we?
Government’s central privacy office
![Page 5: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/5.jpg)
The Office of the Information
and Privacy Commissioner (OIPC):
➢ review actions and decisions of
organizations under PIPA
➢ power to initiate audits and investigations
➢ issue binding orders
➢ can issue fines
➢ provide guidance resources (Privacy Right, PIA Template)
www.oipc.bc.ca
![Page 6: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/6.jpg)
So…what is privacy?
![Page 7: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/7.jpg)
![Page 8: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/8.jpg)
Informational Self-Determination
![Page 9: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/9.jpg)
spatialphysical
informational
![Page 11: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/11.jpg)
Personal Informationmeans recorded information about an identifiable individual other than business contact information or work product information.
![Page 12: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/12.jpg)
Mosaic Effect
![Page 13: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/13.jpg)
Information is an asset.
![Page 14: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/14.jpg)
Right information.Right person.Right purpose.Right time.Right way.
![Page 15: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/15.jpg)
Ordering Pizza in the 21st Century
https://www.aclu.org/ordering-pizza
![Page 16: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/16.jpg)
![Page 17: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/17.jpg)
B.C’s Privacy Legislation Landscape
PIPAFOIPPA
Freedom of Information and
Protection of Privacy Act
Personal Information
Protection Act
PIPAFOIPPAPIPAFOIPPA
✓ Public Bodies ✓ Private Sector
![Page 18: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/18.jpg)
Which Privacy Laws
Apply and When?
*for private sector
Freedom of Information and Protection of Privacy Act (FOIPPA):
• Applies in the instances when private sector organizations are contracted out by a public body
Personal Information Protection Act (PIPA):
• Applies in all other instances
![Page 19: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/19.jpg)
Personal Information Protection Act(PIPA)
![Page 20: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/20.jpg)
20
![Page 21: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/21.jpg)
• A public body (or info under FOIPPA)
• Personal, journalistic, artistic, and domestic uses
• The courts
• Information captured by PIPEDA
PIPA
![Page 22: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/22.jpg)
Group Activity
Does PIPA apply?
1. Roberta researching family history, gathers info about relatives, many of whom live in BC, from various sources.
2. You take a selfie with Duchess Meghan Markle while she’s going for ajog on Dallas Road.
3. Accounting firm handles payroll info for municipality.
4. The Greater Victoria Church of the Fonz collects congregant contact information for the upcoming fundraising campaign aimed at helping millennials learn about retro. TV shows.
![Page 23: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/23.jpg)
PIPA:law based on
principles
1. Identify Purposes
2. Limit Collection
3. Get Consent
4. Limit Use, Disclosure & Retention
5. Reasonable Security
6. Be Accountable
7. Be Open & Transparent
8. Ensure Accuracy
9. Right of Access/ Correction or Annotation
10. Provide Recourse
![Page 24: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/24.jpg)
1
Identify Purpose✓ Must be reasonable
✓ Must provide contact
![Page 25: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/25.jpg)
2
Limit Collection ➢ Only what is necessary, reasonable
and appropriate
➢ With notice
➢ Directly from the individual
![Page 26: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/26.jpg)
![Page 27: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/27.jpg)
Is this collection of Personal Information “reasonable”?
❑Would your doggie daycare company need your home phone number?
❑Would a retailer taking your credit card’s imprint need your phone number? Your SIN?
❑Would a mattress company need your level of income or education on a warranty card?
❑Would a sports team need to collect detailed health information from its players?
![Page 28: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/28.jpg)
3
Get Consent✓ Collect personal information
✓ Collect from a 3rd party
✓ Use/Disclosure of PI
![Page 29: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/29.jpg)
“Valid” Consent
![Page 30: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/30.jpg)
1. Explicit (Express)2. Implicit (Deemed)3. Opt Out
Forms of consent
![Page 31: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/31.jpg)
Which form of consent should be used?
Consider:
✓ Reasonable expectations
✓ Circumstanceof the collection
✓ Sensitivity of the information
![Page 32: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/32.jpg)
Collection without consent.*limited circumstances
* collection must still be reasonable and appropriate
![Page 33: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/33.jpg)
Considering Whether Consent is Needed
❑ The information is in a phone book
available to the public. Can it be collected
by an organization?
❑ Can a protest organizer collect personal
information by observing individuals that
attended a public awareness event?
❑ A client receiving counselling passes away
and the police want personal information
about their sessions. Is the counsellor able
to provide the information?
![Page 34: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/34.jpg)
Tips for obtaining consent
➢ Record it
➢ No deception
➢ Don’t make consent as a condition
➢ Do not prohibit withdrawal
![Page 35: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/35.jpg)
Group Activity
You run a local childcare business called Later Tots. You request that parents of new children consent to completing a questionnaire about themselves, their children and provide any other necessary information.
1. What would be reasonable to ask as part of questionnaire?
2. What would be unreasonable to ask?
3. In caring for the children, which instances for handling personal information would allow for implicit or explicit consent and why?
4. In caring for the children, are there times where consent would not be required when handling personal information?
![Page 36: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/36.jpg)
Employee
Personal Information
➢ Not consent-based➢ Must collect, use, disclose:
▪ For a reasonable purpose▪ For employment relationship only
➢ Must notify (limited exceptions may apply)
![Page 37: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/37.jpg)
Would the following be considered a reasonable collection of employee
personal information?
❑ Asking prospective employees of a retail store whether they are smokers because of cigarette smoke odour concerns
❑ Video taping or monitoring employees where there is no known employment issue
❑ Use of credit checks in the employee hiring process
![Page 38: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/38.jpg)
44
Limit Use, Disclosure,
& Retention
![Page 39: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/39.jpg)
1. The same purpose for which it was obtained.
2. Other limited PIPA authorities
Limit USE and DISCLOSURE
to…
New Purpose?
Get NEWconsent!
![Page 40: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/40.jpg)
Need to know vs. nice to know
But I might
need it later.
![Page 41: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/41.jpg)
![Page 42: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/42.jpg)
Would the following use or disclosure be okay?
❑Could an organization notify the police about a client that they have seen in a wanted poster?
❑Could an organization use photos of people relaxing at the beach in their promotional material?
❑Could an organization use personal information to do a reference check from job applicants on references provided?
❑Could an organization use an employee’s SIN as a password for daily timekeeping
![Page 43: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/43.jpg)
Limit Retention
![Page 44: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/44.jpg)
Making a decision that directly affects an individual?
![Page 45: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/45.jpg)
5
Reasonable Security
![Page 46: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/46.jpg)
Privacy and Security
Reasonable security is …
proportional to the sensitivity of
the personal information
❖ Physical❖ Technological❖ Organizational
![Page 47: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/47.jpg)
Security Tips
➢Ensure staff awareness
➢Ensure sufficient monitoring
➢Ensure access to a contact for questions
➢Ensure plan for reporting incidents
![Page 48: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/48.jpg)
Group Activity
In terms of securing personal information, pleaseshare what you have done within your ownorganization.
OR
If you are unable to share about your ownorganization, provide hypothetical tips that can beused by Later Tots as it relates to the questionnairethey ask parent’s complete.
![Page 50: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/50.jpg)
PERSONAL vs. Confidential
![Page 51: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/51.jpg)
An information incident is
an unwanted or unexpected
event
that threatens the privacy or security of
confidential information.
Includes privacy breaches
![Page 52: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/52.jpg)
WHAT IS A PRIVACY BREACH?
![Page 53: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/53.jpg)
Information Incident
No
Privacy Breach
Privacy Complaint
Information Incident
Yes
Is personal
information
involved?
![Page 54: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/54.jpg)
Administrative
Errors
Deliberate Employee
Actions
Loss/Theft of Mobile
Devices
➢ Mail, email, fax
➢ Account errors
➢ Human
error/accidental
➢ Snooping
➢ Leaks/unauthorized
disclosure
➢ Laptops, hard
drives, USB keys,
mobile phones
![Page 55: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/55.jpg)
The majority of breaches are due to .human error
![Page 56: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/56.jpg)
Information Incident
Management Process
Step 1 - Report
Step 2 - Recover
Step 3 - Remediate
Step 4 - Prevent
![Page 57: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/57.jpg)
Reportall actual or suspected incidents
immediately.
What is your process …???
Does your staff know it …???
Step 1:Report
![Page 58: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/58.jpg)
Step 2:Recover
Containment Measures
➢Recovering physical documents
➢Shredding documents
➢Correcting system errors
➢Double deletion of emails
➢Restricting system access
![Page 59: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/59.jpg)
When personal or
sensitive information has
been breached,
notification to the affected
individuals needs to be assessed.
Step 3:Remediate
![Page 60: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/60.jpg)
Step 3
Notification is determined
through a harms assessment.
![Page 61: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/61.jpg)
Step 4Prevention
![Page 62: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/62.jpg)
Prevention is key!
![Page 63: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/63.jpg)
6
Be Accountable✓ Based on “reasonable person test”
![Page 65: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/65.jpg)
7
Be Open & Transparent
![Page 66: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/66.jpg)
❖Write Policies
❖Collection
Notices (for PI)
❖Develop
Material (e.g.
brochures)
![Page 67: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/67.jpg)
8
Ensure Accuracy➢ Proactive duty of “Reasonable Effort”
![Page 68: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/68.jpg)
9
Right of Access /
Correction or Annotation
![Page 69: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/69.jpg)
Right of Access
1. Access to their personal information.
2. Explain how their personal information is being/has been used.
3. Identify who their personal information has been disclosed to.
![Page 70: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/70.jpg)
![Page 71: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/71.jpg)
An individual has the right to request correction of their personal information.
➢ If denied => right to annotation
![Page 72: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/72.jpg)
![Page 73: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/73.jpg)
10
Provide Recourse
![Page 74: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/74.jpg)
Organizations must develop process for responding to
complaints.
![Page 75: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/75.jpg)
Group Activity
The Soggiest Survivor, an outdoor survival reality show, is being filmed off the rugged coasts of Vancouver Island. You’ve been asked to work as a Privacy Officer for the development of this television show. How would you apply the principles found in the privacy wheel to enhance contestant’s privacy?
![Page 76: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/76.jpg)
Resources!PCT’s webpage providing information on your PIPA obligationshttps://www2.gov.bc.ca/gov/content/employment-business/business/managing-a-business/protect-personal-information
PrivacyRight: Information from the OIPC helping small businesses and organizations understand their PIPA obligationshttps://www.oipc.bc.ca/privacyright/
A helpful guide from the OIPC relating to PIPAhttps://www.oipc.bc.ca/guidance-documents/1438
Privacy Impact Assessment Guidelines for the Private Sectorhttps://www.oipc.bc.ca/guidance-documents/2382
![Page 77: A Principled Approach: Lessons on PIPA and the Privacy ... · Right information. Right person. Right purpose. Right time. Right way. Ordering Pizza in the 21. st. Century. ... a reference](https://reader033.vdocuments.us/reader033/viewer/2022043018/5f3aa33a5ceb005a8d4fd20a/html5/thumbnails/77.jpg)
www.gov.bc.ca/protectprivacy
250-356-1851(Service BC 1-800-663-7867)
BC Privacy and Access Helpline