Discuss IAPP CIPP/C Exam Topic 5 Question 36

According to the Canadian Standards Association (CSA) Model Code, how long should personal information be retained?

APersonal information should not be retained at all.

BPersonal information should be retained indefinitely as long as consent has been given.

CPersonal information should be retained for at least two years after the last administrative use.

DPersonal information should be retained as long as necessary for the fulfillment of the purpose of the collection.

Suggested Answer: B

Get Premium CIPP/C Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

36 comments · newest first

Helene 11 months ago

Totally agree with you, Cherilyn!

Hyman 12 months ago

C is incorrect; it's all about the purpose!

Tula 12 months ago

Wait, can they really keep it forever if they want?

Hildred 12 months ago

Yeah, definitely D! Makes the most sense.

Cherilyn 1 year ago

I think it's D, right? Retain as long as needed.

Bambi 1 year ago

I’m pretty certain that consent plays a role, but I don't think it means indefinite retention. I lean towards option D as well.

Dominic 1 year ago

I vaguely recall something about a two-year retention period, but that might have been for a different regulation.

Maile 1 year ago

I practiced a question like this, and I feel like the answer was related to the purpose of the collection. Maybe it's option D?

Tom 1 year ago

I think I remember that personal information shouldn't be kept longer than necessary, but I'm not sure about the exact time frame.

Carri 1 year ago

Okay, I've got this. The CSA Model Code states that personal information should be retained for as long as it's needed to fulfill the purpose of collection. So the answer is definitely D.

Corinne 1 year ago

Hmm, I'm a bit unsure on this. I know the CSA Code covers personal data, but I can't remember the exact retention guidelines. I'll have to think this through carefully.

Enola 1 year ago

I'm pretty confident about this one. The CSA Model Code is all about data privacy, so I think the answer is D - personal information should be retained as long as necessary for the purpose it was collected for.

Rickie 1 year ago

Ah, this is a tricky one. I remember learning about the CSA Code, but the details on retention periods are a bit fuzzy. I'll have to review my notes to see if I can narrow it down.

Dannie 1 year ago

Hmm, I'm a bit unsure about this one. I know risk analysis is important, but I'm not totally clear on the specific initial steps. I'll have to think it through carefully.

Laurel 1 year ago

Ugh, I'm a little fuzzy on the details of the vEdge product line. I'll have to make an educated guess on this one.

Rocco 1 year ago

Okay, I remember learning about the seven types of waste in Lean Principles. I think the answer is A, Waste. I'll double-check my understanding, but I'm feeling good about this one.

Therese 1 year ago

Hmm, I'm a bit confused by the wording here. I'll need to make sure I understand what the "Direct Authentication" and "Data Confidentiality" patterns are and how they relate to preventing unauthorized access. Let me re-read this a few times.

Odette 2 years ago

Definitely going with D. Retaining personal info for at least two years after use? That's just asking for trouble.

Lettie 1 year ago

↳ replying to Odette

Yeah, it makes sense to retain personal information only for as long as necessary.

Truman 1 year ago

↳ replying to Odette

I agree, option D seems like the most reasonable choice.

Ty 2 years ago

Haha, A is just too extreme. 'Personal information should not be retained at all'? Yeah, right, good luck with that!

Felicidad 1 year ago

↳ replying to Ty

I think D makes the most sense, retain it as long as necessary for the purpose.

Terrilyn 1 year ago

↳ replying to Ty

I agree, personal information needs to be retained for a certain period of time.

Annett 1 year ago

↳ replying to Ty

I know, right? A is definitely not practical.

Delmy 2 years ago

I'm torn between B and D, but I think D is the safer choice. You don't want to hold on to sensitive data longer than necessary.

Cecily 2 years ago

Option D seems the most reasonable to me. Retaining personal information indefinitely even with consent seems like a privacy violation waiting to happen.

Karina 1 year ago

↳ replying to Cecily

I think we can all agree that protecting personal information should be a top priority.

Nickolas 1 year ago

↳ replying to Cecily

I see your point, but I still believe option D is the best way to ensure personal information is only kept for as long as necessary.

Merilyn 1 year ago

↳ replying to Cecily

I think option C is also a good choice, as it ensures personal information is retained for a reasonable period of time.

Dona 1 year ago

↳ replying to Cecily

I agree, option D makes the most sense in terms of privacy protection.

Carissa 2 years ago

But what about privacy concerns? Shouldn't personal information be deleted after a certain period of time to protect individuals?

Sherell 2 years ago

I agree with Cathrine. It's important to keep personal information for the intended purpose.

Cathrine 2 years ago

I think personal information should be retained as long as necessary for the fulfillment of the purpose of the collection.

Jade 2 years ago

I believe personal information should not be retained at all to protect privacy.

Isidra 2 years ago

I agree with Valentin. It's important to keep personal information for the intended purpose.

Valentin 2 years ago

I think personal information should be retained as long as necessary for the fulfillment of the purpose of the collection.

IAPP CIPP/C Exam - Topic 5 Question 36 Discussion