A private security firm, acting as a third-party contractor for a large retail chain, collects personal information from customers for a loyalty program. According to PIPEDA, who bears the primary responsibility for ensuring adherence to the fair information principles regarding this collected data?

Question: A private security firm, acting as a third-party contractor for a large retail chain, collects personal information from customers for a loyalty program. According to PIPEDA, who bears the primary responsibility for ensuring adherence to the fair information principles regarding this collected data?

Answer options: ✅ The retail chain, as the organization ultimately controlling the purpose of the collection.

• The security firm, as they are directly collecting and processing the personal information.
• Both the retail chain and the security firm, sharing joint and equal responsibility.
• The individual customers, by providing their consent to participate in the loyalty program.

Correct answer: The retail chain, as the organization ultimately controlling the purpose of the collection.

Explanation: Under PIPEDA, even when personal information is transferred to a third party for processing, the original organization that collected the data remains accountable for its protection. The retail chain, being the principal organization, retains primary responsibility for compliance with the fair information principles.