A private sector daycare’s portal for parents stores their children’s photos, allergy information date of birth. A parent has asked about the portal’s security requirements and in three months still not has received an answer. What is missing from the daycare’s procedures?

The most direct procedural failure is the daycare's non-compliance with the mandated response time for an access request. Under PIPEDA's Principle 4.9 (Individual Access), and specifically section 8(3) of the Act, an organization must respond to a request for information within 30 days of its receipt. The parent's inquiry about security requirements for their child's personal information constitutes such a request. By failing to respond for three months, the daycare has violated this explicit timeline. While transparency and security are important, the immediate, quantifiable breach of procedure is the failure to provide a timely response.

A. A lack of transparency is a broader issue; the specific violation here is the failure to meet the statutory deadline for a response, which is a component of transparency.
C. While strong security is required, the question is about the failure to respond to an inquiry about security, not about the security measures themselves.
D. A RROSH assessment is conducted after a breach has occurred to determine reporting obligations, not in response to a parent's general inquiry.

1. Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Section 8(3). "An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request."

2. Office of the Privacy Commissioner of Canada. (2019). PIPEDA in Brief. "Individuals have the right to access the personal information held by an organization... Organizations must respond to an access request within 30 days."

3. Bennett, C. J., & Raab, C. D. (2006). The Governance of Privacy: Policy Instruments in Global Perspective. MIT Press. (Discusses individual access rights as a core component of data protection regimes like PIPEDA, including specified time limits for responses).