A security guard working for a private company observes a client's employee looking at sensitive files without authorization. Under PIPEDA principles, what is the most appropriate action regarding the employee's personal information (e.g., name, employee ID) if reported?

Question: A security guard working for a private company observes a client's employee looking at sensitive files without authorization. Under PIPEDA principles, what is the most appropriate action regarding the employee's personal information (e.g., name, employee ID) if reported?

Answer options:

• Immediately share the employee's details with other security companies in the area. ✅ Gather only the personal information absolutely necessary to identify the individual and detail the incident for internal reporting.
• Post the employee's name and alleged offense on a public notice board.
• Delete all records of the incident to avoid privacy concerns.

Correct answer: Gather only the personal information absolutely necessary to identify the individual and detail the incident for internal reporting.

Explanation: PIPEDA's principle of 'Limiting Collection' states that the collection of personal information shall be limited to that which is necessary for the purposes identified. Security guards should only collect information essential for incident reporting and investigation, ensuring it's relevant and not excessive.