When should an APP entity destroy or de-identify personal information?

Question

BlackTom AI · Accepted Answer

The question asks about when an APP entity should destroy or de-identify personal information. 
Option a: 'Once it is no longer needed for any purpose under the APPs' aligns with the principle that organisations should take reasonable steps to destroy or de-identify personal information when it is no longer needed for any of the purposes for which it was collected, in line with APP 11 (Security) and the broader data minimisation and retention guidance. This emphasizes timely deletion when there is no ongoing purpose under the APPs. 
Option b: 'As soon as it is collected' suggests immediate destruction, which is not appropriate because information often needs to be retained to fulfill the purposes for which it was collected or to comply with legal obligations; premature destruction undermines legitimate business needs and legal compliance. 
Option c: 'Only if required by law' incorrectly narrows the duty. While legal retention requirements exist, the decision to destroy or de-identify should be based on whether the information is still needed for the purposes of collection under the APPs, not solely on legal mandates. Proactive de-identification or destruction when no longer needed is a best practice beyond mere legal obligation. 
Option d: 'Never' is incorrect because there are clear expectations under privacy principles to securely destroy or de-identify personal information when it is no longer required, to mitigate ongoing risk of exposure or misuse. 
 Overall, the reasoning supports destroying or de-identifying when the information is no longer needed for any APP purposes, rather than keeping it indefinitely, prematurely destroying it, waiting for a legal trigger, or never removing it.

When should an APP entity destroy or de-identify personal information?单项选择题

类似问题

The General Data Protection Regulation (GDPR) primarily embodies which ethical framework?

The question of whether a manufacturer has rights to utilize data collected from a health monitoring device to improve future versions of the product is a concern of:

What does privacy legislation such as the Australian Privacy Act 1988 enable individuals to control?

Which legal risk is associated with the collection of user-generated data?

Canada's PIPEDA (Personal Information Protection and Electronic Documents Act) contains rules regarding all the following except

What is the primary focus of APP 1?

APP 6 requires that personal information used for secondary purposes must:

How should personal information be collected?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单