NPPE Privacy Law and Confidentiality

Question 1

Under PIPEDA (Personal Information Protection and Electronic Documents Act), which principle requires that personal information be collected only for purposes that a reasonable person would consider appropriate in the circumstances?

Accepted Answer

The principle of identifying purposes

Answer

The 'Identifying Purposes' principle under PIPEDA (Schedule 1, Principle 2) requires organizations to identify the purposes for which personal information is collected at or before the time of collection, and those purposes must be ones a reasonable person would consider appropriate. This prevents collection for vague or unjustifiable reasons.

Question 2

A professional engineer learns during a project that a client's facility has an unreported environmental contamination that poses a risk to a neighbouring community. Regarding confidentiality, the engineer should:

Accepted Answer

Advise the client to address the issue and, if they refuse and danger to the public persists, consider disclosure to the appropriate authority

Answer

Confidentiality is a professional obligation, but it is not absolute when public safety or environmental harm is at stake. The standard approach is to first advise the client to rectify the situation. If the client refuses and a serious risk to the public or environment persists, disclosure to the relevant regulatory authority may be not only permitted but required under codes of ethics and environmental legislation.

Question 3

An engineer stores project files containing client personal information on a laptop that is subsequently stolen. Under Canadian privacy law, the engineer's organization is likely required to:

Accepted Answer

Notify affected individuals and report the breach to the Privacy Commissioner if it creates a real risk of significant harm

Answer

Under PIPEDA's mandatory breach notification requirements (in force since November 2018), organizations must report breaches of security safeguards to the Office of the Privacy Commissioner and notify affected individuals when the breach creates a 'real risk of significant harm.' This includes theft of devices containing personal information. Waiting for harm to materialize before notifying is not compliant.

Question 4

Which of the following most accurately describes the professional duty of confidentiality that an engineer owes to a former client after the engagement ends?

Accepted Answer

The duty of confidentiality continues indefinitely with respect to information obtained during the professional relationship

Answer

The professional duty of confidentiality survives the termination of the client relationship. Information obtained in confidence during an engagement — including business strategies, proprietary processes, or sensitive project details — remains confidential indefinitely unless the client consents to disclosure or a lawful exception applies (such as a court order or a duty to prevent harm).

Question 5

An engineer is asked by a new employer to use detailed design calculations they developed while employed at a previous firm. The previous firm's data was not covered by a written confidentiality agreement. The engineer should:

Accepted Answer

Treat the information as confidential regardless of a written agreement, as a professional duty of confidentiality exists independent of contract

Answer

Professional confidentiality is an ethical and legal duty that arises from the professional relationship itself, not solely from a written contract. Proprietary design information created for a former client or employer is confidential even without a formal NDA. Using it without authorization could constitute a breach of professional duty and potentially misappropriation of confidential information.

NPPE - National Professional Practice Examination Practice Test

NPPE - National Professional Practice Examination Practice Test

NPPE Privacy Law and Confidentiality