A private sector daycare’s portal for parents stores their children’s photos, allergy information and date...

In the scenario described, the most significant procedural flaw at the daycare is their failure to respond to the parent's request about the portal’s security measures within a reasonable time frame. Under the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations are required to respond to such requests within 30 days. This timeframe is mandated to ensure transparency and to provide individuals with timely access to information about the handling of their personal data. The daycare’s failure to provide an answer within this period violates PIPEDA's provisions regarding the access to personal information and the accountability of organizations in managing this data securely and transparently.