A. COLLECTION KEY REQUIREMENTS: . For each collection of personal information, ensure that the institution collects personal information only if it has the authority to do so. Consider the following: o Is the collection expressly authorized by statute? o Will the personal information be used for law enforcement purposes? o Is the collection necessary for the proper administration of a lawfully authorized activity? . Personal information should be collected directly from the individual to whom it relates, unless another manner of collection is authorized by the individual or statute. . Notify the individual of the collection, including legal authority, purpose(s), and contact information of a person who can answer questions about the collection. . See sections 28 and 29 of MFIPPA and sections 38 and 39 of FIPPA -

if someone can please help me fill in the blanks

website for reference: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3999529/pdf/policy-08-087.pdf

PRIVACY REQUIREMENT QUESTIONS FINDINGS EXPLANATION PRIVACY IMPACT ACTION ITEMS AUTHOR ITY Is the collection of personal information authorized under FIPPA or MFIPPA or another act? Do all parties collecting personal information have legal authority for the collection? Has responsibility for the collection been assigned to program staff or third party service providers? Personal information may be collected if permitted by applicable privacy legislation, such as FIPPA (Freedom of Information and Protection of Privacy Act). MFIPPA (Municipal Freedom of Information and Protection of Privacy Act). or another applicable act. The collection of personal information is permitted under applicable privacy legislation such as FIPPA, MFIPPA. or another applicable act. Specic legal requirements must be met to ensure proper authorization. The collection process complies with the requirements outlined in the applicable privacy legislation, conrming that the authorization is not only asserted but also legally supported... All parties collecting personal information have the legal authority to do so. This ensures that privacy laws are followed and reduces the risk of unauthorized data collection. Regular audits ensure that privacy laws are being followed, and timely updates incorporate legal changes into data collection processes to ensure compliance. Regular audits and timely updates are actions to ensure that all parties collecting personal information have the legal authority to do so and are in compliance with privacy laws. QUESTIONS PURPOSE OF COLLECTION Has the purpose of the collection been defined? What is the purpose of the collection? NOTICE TO INDIVIDUAL Will notice of collection be provided to the individual(s)? Explain timing, method, and exemptions from notice, where authorized. Will the notice of collection comply with FIPPA or MFIPPA? Explain how or missing components MANNER OF COLLECTION/SOURCE OF PERSONAL INFORMATION Will personal information be collected directly from the individual? Explain the form of collection (for example, orally, hardcopy form, online portal, etc.) Will personal information be collected indirectly from another source, or covertly? Why? Will indirect collection comply with FIPPA or MFIPPA? Explain authority for indirect collection. CONTROLS Will the project only collect personal information for which there is legal authority?FINDINGS PRIVACY REQUIREMENT Y N IP NA EXPLANATION PRIVACY IMPACT ACTION ITEMS QUESTIONS Will there be periodic reviews of the collection controls to ensure effectiveness? DATA MINIMIZATION Is personal information necessary for the project to proceed? Is collection of all the personal information necessary? Why or why not