Privacy Law and Confidentiality Flashcards

Under PIPEDA (Personal Information Protection and Electronic Documents Act), which principle requires that personal information be collected only for purposes that a reasonable person would consider appropriate in the circumstances?

Answer: The principle of identifying purposes

The 'Identifying Purposes' principle under PIPEDA (Schedule 1, Principle 2) requires organizations to identify the purposes for which personal information is collected at or before the time of collection, and those purposes must be ones a reasonable person would consider appropriate. This prevents collection for vague or unjustifiable reasons.

A professional engineer learns during a project that a client's facility has an unreported environmental contamination that poses a risk to a neighbouring community. Regarding confidentiality, the engineer should:

Answer: Advise the client to address the issue and, if they refuse and danger to the public persists, consider disclosure to the appropriate authority

Confidentiality is a professional obligation, but it is not absolute when public safety or environmental harm is at stake. The standard approach is to first advise the client to rectify the situation. If the client refuses and a serious risk to the public or environment persists, disclosure to the relevant regulatory authority may be not only permitted but required under codes of ethics and environmental legislation.

An engineer stores project files containing client personal information on a laptop that is subsequently stolen. Under Canadian privacy law, the engineer's organization is likely required to:

Answer: Notify affected individuals and report the breach to the Privacy Commissioner if it creates a real risk of significant harm

Under PIPEDA's mandatory breach notification requirements (in force since November 2018), organizations must report breaches of security safeguards to the Office of the Privacy Commissioner and notify affected individuals when the breach creates a 'real risk of significant harm.' This includes theft of devices containing personal information. Waiting for harm to materialize before notifying is not compliant.

Which of the following most accurately describes the professional duty of confidentiality that an engineer owes to a former client after the engagement ends?

Answer: The duty of confidentiality continues indefinitely with respect to information obtained during the professional relationship

The professional duty of confidentiality survives the termination of the client relationship. Information obtained in confidence during an engagement — including business strategies, proprietary processes, or sensitive project details — remains confidential indefinitely unless the client consents to disclosure or a lawful exception applies (such as a court order or a duty to prevent harm).

An engineer is asked by a new employer to use detailed design calculations they developed while employed at a previous firm. The previous firm's data was not covered by a written confidentiality agreement. The engineer should:

Answer: Treat the information as confidential regardless of a written agreement, as a professional duty of confidentiality exists independent of contract

Professional confidentiality is an ethical and legal duty that arises from the professional relationship itself, not solely from a written contract. Proprietary design information created for a former client or employer is confidential even without a formal NDA. Using it without authorization could constitute a breach of professional duty and potentially misappropriation of confidential information.

An opposing party's lawyer subpoenas an engineer to produce confidential project documents in litigation. What should the engineer do first?

Answer: Notify the client and seek legal advice before producing any documents, as the client may have grounds to assert privilege or confidentiality

A subpoena is a legal compulsion to produce documents, but the first step is to notify the client (who may wish to assert solicitor-client privilege or seek a protective order) and obtain legal advice. The engineer should not produce documents without giving the client an opportunity to protect their interests. However, if a court ultimately orders production, the engineer must comply — professional confidentiality does not override a valid court order.