NPPE Privacy Law and Confidentiality — Questions and Answers
Question 1: Under PIPEDA (Personal Information Protection and Electronic Documents Act), which principle requires that personal information be collected only for purposes that a reasonable person would consider appropriate in the circumstances?
- The principle of accuracy
- The principle of limiting collection
- The principle of identifying purposes (Correct answer)
- The accountability principle
Correct answer: The principle of identifying purposes
The 'Identifying Purposes' principle under PIPEDA (Schedule 1, Principle 2) requires organizations to identify the purposes for which personal information is collected at or before the time of collection, and those purposes must be ones a reasonable person would consider appropriate. This prevents collection for vague or unjustifiable reasons.
Question 2: A professional engineer learns during a project that a client's facility has an unreported environmental contamination that poses a risk to a neighbouring community. Regarding confidentiality, the engineer should:
- Maintain strict confidentiality since client information is always privileged
- Disclose immediately to any media outlet to maximize public awareness
- Advise the client to address the issue and, if they refuse and danger to the public persists, consider disclosure to the appropriate authority (Correct answer)
- Withdraw from the project without disclosing the information to anyone
Correct answer: Advise the client to address the issue and, if they refuse and danger to the public persists, consider disclosure to the appropriate authority
Confidentiality is a professional obligation, but it is not absolute when public safety or environmental harm is at stake. The standard approach is to first advise the client to rectify the situation. If the client refuses and a serious risk to the public or environment persists, disclosure to the relevant regulatory authority may be not only permitted but required under codes of ethics and environmental legislation.
Question 3: An engineer stores project files containing client personal information on a laptop that is subsequently stolen. Under Canadian privacy law, the engineer's organization is likely required to:
- File a police report only — no notification to the privacy regulator or affected individuals is required
- Notify affected individuals and report the breach to the Privacy Commissioner if it creates a real risk of significant harm (Correct answer)
- Delete all other copies of the information immediately to limit exposure
- Wait to see if the information is misused before taking any action
Correct answer: Notify affected individuals and report the breach to the Privacy Commissioner if it creates a real risk of significant harm
Under PIPEDA's mandatory breach notification requirements (in force since November 2018), organizations must report breaches of security safeguards to the Office of the Privacy Commissioner and notify affected individuals when the breach creates a 'real risk of significant harm.' This includes theft of devices containing personal information. Waiting for harm to materialize before notifying is not compliant.
Question 4: Which of the following most accurately describes the professional duty of confidentiality that an engineer owes to a former client after the engagement ends?
- The duty of confidentiality ends automatically when the engineer-client relationship terminates
- The engineer may disclose former client information freely, provided one year has passed since the project ended
- The duty of confidentiality continues indefinitely with respect to information obtained during the professional relationship (Correct answer)
- Confidentiality obligations apply only to trade secrets, not to general project information
Correct answer: The duty of confidentiality continues indefinitely with respect to information obtained during the professional relationship
The professional duty of confidentiality survives the termination of the client relationship. Information obtained in confidence during an engagement — including business strategies, proprietary processes, or sensitive project details — remains confidential indefinitely unless the client consents to disclosure or a lawful exception applies (such as a court order or a duty to prevent harm).
Question 5: An engineer is asked by a new employer to use detailed design calculations they developed while employed at a previous firm. The previous firm's data was not covered by a written confidentiality agreement. The engineer should:
- Use the calculations freely, since no written agreement was signed
- Use the calculations, as they represent the engineer's own professional skill and knowledge
- Treat the information as confidential regardless of a written agreement, as a professional duty of confidentiality exists independent of contract (Correct answer)
- Ask the new employer to obtain a court order permitting use of the data
Correct answer: Treat the information as confidential regardless of a written agreement, as a professional duty of confidentiality exists independent of contract
Professional confidentiality is an ethical and legal duty that arises from the professional relationship itself, not solely from a written contract. Proprietary design information created for a former client or employer is confidential even without a formal NDA. Using it without authorization could constitute a breach of professional duty and potentially misappropriation of confidential information.
Question 6: An opposing party's lawyer subpoenas an engineer to produce confidential project documents in litigation. What should the engineer do first?
- Immediately produce all documents to comply with the legal process
- Destroy the documents to prevent disclosure
- Notify the client and seek legal advice before producing any documents, as the client may have grounds to assert privilege or confidentiality (Correct answer)
- Refuse to comply on the basis that professional confidentiality overrides all court orders
Correct answer: Notify the client and seek legal advice before producing any documents, as the client may have grounds to assert privilege or confidentiality
A subpoena is a legal compulsion to produce documents, but the first step is to notify the client (who may wish to assert solicitor-client privilege or seek a protective order) and obtain legal advice. The engineer should not produce documents without giving the client an opportunity to protect their interests. However, if a court ultimately orders production, the engineer must comply — professional confidentiality does not override a valid court order.
NPPE Privacy Law and Confidentiality
Under PIPEDA (Personal Information Protection and Electronic Documents Act), which principle requires that personal information be collected only for purposes that a reasonable person would consider appropriate in the circumstances?