Which act requires organizations to obtain consent for collecting, using, or disclosing personal information and to publish clear policies?

Which act requires organizations to obtain consent for collecting, using, or disclosing personal information and to publish clear policies?

• A. Payment Card Industry Data Security Standard (PCI DSS)
• B. Personal Information Protection and Electronic Documents Act (PIPEDA)
• C. Children's Online Privacy Protection Act (COPPA)
• D. Common Criteria (CC)

Answer: (B)

This question tests data privacy requirements that link consent to the collection, use, or disclosure of personal information and the obligation to publish clear privacy practices. The best fit is a Canadian law that mandates organizations to obtain meaningful consent for handling personal information and to publish a privacy policy that explains how data is collected, used, and shared. This law applies to private-sector organizations and emphasizes both consent and transparency about information practices. Other options focus on different areas: one is a security standard for protecting payment card data, not about consent or publishing privacy policies; another deals with protecting children’s online data and parental consent for that subset of information; and the last is a framework for evaluating the security of IT products, not a privacy consent regime.

This question tests data privacy requirements that link consent to the collection, use, or disclosure of personal information and the obligation to publish clear privacy practices. The best fit is a Canadian law that mandates organizations to obtain meaningful consent for handling personal information and to publish a privacy policy that explains how data is collected, used, and shared. This law applies to private-sector organizations and emphasizes both consent and transparency about information practices.

Other options focus on different areas: one is a security standard for protecting payment card data, not about consent or publishing privacy policies; another deals with protecting children’s online data and parental consent for that subset of information; and the last is a framework for evaluating the security of IT products, not a privacy consent regime.