Prima Canada Personal Information Protection Policy
- Policy objectives
- Why do we collect personal information?
- What personal information do we collect?
- Who can see your personal information?
- How do we protect your personal information?
- Consent
- Retention and destruction of personal information
- Access to and correction of personal information
- Our roles and responsibilities
- Monitoring and evaluation
- Related Reference Materials
- Questions or complaints
Policy objectives
In the exercise of our mandate, under the Personal Information Protection Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), we, Prima Canada and its divisions collect personal information as provided by section 4 of the Act respecting the protection of personal information in the private sector. Prima Canada is committed to protecting the right to privacy of all people about whom it has collected personal information. The personal information of our employees is subject to the Policy on the Protection of Personal Information of Prima Canada Employees and not to this policy.
This policy respects the Personal Information Protection Act and the principles of natural justice.
Why do we collect personal information?
We collect personal information for various reasons. In general, the information collected relates to our business needs for each division. We may also collect information for administrative purposes, for example, to send results to a professional partner. Information may also be collected within the framework of internal statistics.
We may only use your personal information for the purposes for which it was collected or for use consistent with those purposes, or for the purposes listed in section 8 of the Act respecting the protection of personal information in the private sector.
What personal information do we collect?
We only collect personal information that is directly related to our activities. Where possible, this information will be collected directly from the person in question. The amount and type of information collected will be limited to what is necessary for the identified purposes. We only collect what we need.
For example, we may ask for your name, date of birth, contact details, passport number, identity card number or collect your opinion in a survey.
Sometimes we get more information than we need. For example, some people indicate their social insurance number on their general information request. We strongly encourage you not to provide information beyond what is necessary.
The personal information described is used or is available for administrative purposes or is classified so that it can be retrieved in the most efficient way, either by the name of the person or a file number.
Who can see your personal information?
We will not disclose your personal information without your consent, unless authorized by subsection 8 (2) of the Act respecting the protection of personal information in the private sector. In the case of an authorized communication, we will attempt to communicate only the specific information that is necessary within the circumstances and, where possible, we will notify the given individual of such communication.
Access to personal information within Prima Canada will be limited to employees who need the information to carry out their tasks. These employees will treat the information in strict confidentially and will not give access to this information to any unauthorized person. The level of access to personal information will be granted to employees on a need-to-know basis.
Any person we hire under contract or otherwise to perform functions on our behalf must comply with the provisions of the Act respecting the protection of personal information in the private sector, as well as this policy and related internal procedures. Any violation of any part of the contractual agreement may result in cancellation of the contract.
How do we protect your personal information?
In any organization, failure to protect personal information can increase the risk of privacy breaches. These breaches can lead to various problems such as damaging the person’s reputation or enabling fraud or identity theft.
We will protect personal information against loss or theft, unauthorized access, use or disclosure, modification or destruction, by appropriate administrative, technical and physical security and protection measures. The level of protection granted to personal information depends on the following elements:
- The degree of sensitivity of personal information;
- The quantity, distribution and format of information;
- The conservation method.
We comply with the Government of Canada Security Policy, as well as, all other directives and guidelines relating to information technology security adopted by relevant federal and provincial agencies.
Consent
When possible, we try to obtain consent from the individual before collecting their personal information. The form of consent may vary depending on the circumstances and the type of information sought. Consent may be express or implied and may be provided directly by the individual or their authorized representative.
We prefer to obtain explicit consent, either verbally, electronically or in writing. Implied consent may be reasonably inferred from an individual’s action or inaction, for example, providing a name and address to receive a publication or a name and telephone number to obtain a response to a question.
To determine the appropriate type of consent, we consider the sensitivity of the personal information involved, the purposes for which it is collected and the reasonable expectations of the individual. If we want to use personal information for a new purpose, we will describe the intended use and ask for consent again.
It is not always possible during an investigation to obtain the person’s consent to collect, use or communicate their personal information. Both the Privacy Act and PIPEDA allow the disclosure of personal information for the purposes of an investigation if it is necessary for the investigation.
We will not use your personal information without your consent, except:
- If they are to be used for the same purposes as those for which the information was initially collected or compiled;
- If the use is compatible with this purpose;
- If they are to be used for a purpose provided for in subsection 8 (2) of the Personal Information Protection Act.
Retention and destruction of personal information
We must ensure that all personal information is treated according to a pre-established life cycle. In accordance with the Personal Information Protection Act and its regulations, personal information that we use to make a decision about an individual will be retained for at least two years after that decision. This period is sufficient to allow someone to pursue legal recourse and exercise all their rights under the Privacy Act.
We will retain personal information in accordance with the maximum recommended retention periods.
The retention, elimination and destruction of personal information are carried out in accordance with the recommendations on privacy practices of the Government of Canada and Quebec.
Access to and correction of personal information
You can access or correct your personal information informally, that is, without using the Personal Information Protection Act. However, you have the right to formally request access to or correction of your personal information under the Privacy Act. You also have the right under the Access to Information Act to officially request access to information contained in Prima Canada files which could include your personal information.
Only formal requests for access to personal information under the Privacy Act give you the right to make a complaint to the Privacy Officer if you are not satisfied with the initial decision. Likewise, you can request a correction of your personal information only if it was provided pursuant to a formal request for access under the Protection of Personal Information Act. Additionally, only formal requests for access to information under the Access to Information Act give you the right to make a complaint.
Prima Canada employees are responsible for directing individuals who wish to formally access or correct their personal information.
We make every effort to ensure that the information used for the purposes of a decision directly concerning an individual is as precise, up to date and complete as possible. This also applies to information communicated to third parties.
Our roles and responsibilities
We are responsible for personal information collected, stored, used, communicated and destroyed in the execution of our mandate. We will continue to develop policies and practices to ensure that this information is handled in strict accordance with the Act respecting the protection of personal information in the private sector. Prima Canada’s Privacy Officer is responsible for monitoring and ensuring compliance with these policies and practices, including, but not limited to:
- Providing the same training to all clinic staff (including temporary employees);
- Ensuring open, complete and timely communication with employees and others regarding the clinic’s policies, practices and expectations regarding the handling of personal information;
- Establishing standards for classifying the sensitivity of personal information to determine the appropriate level of protection for that information;
- Implementing systems that ensure that only employees whose functions require access to personal information are authorized to have access to the information in question;
- Including specific provisions in contracts or other arrangements concluded with third parties, which require compliance with the Act respecting the protection of personal information in the private sector;
- Ensuring that procedures are in place for individuals to request access to and request corrections to their personal information, and to file complaints regarding the management of their personal information;
- Ensuring that procedures are in place to notify individuals of any inappropriate collection, retention, use, disclosure or destruction of their personal information;
- Monitoring the degree of compliance with this policy and, if necessary, taking measures to correct any deficiencies.
Employees — Staff members who collect personal information on behalf of Prima Canada must explain for what purposes the information is obtained. If they cannot do this, they will be required to refer the person to another employee who can explain the reason for the collection. It is the responsibility of each Prima Canada employee to inform themselves about their obligations under this policy and the Act respecting the protection of personal information in the private sector. Employees must report any violation of the Policy or the Law to their manager or to the person responsible for the protection of personal information.
Managers and supervisors — In addition to the responsibilities noted above, managers and supervisors must inform their employees of the obligation to comply with the Policy and the Act. They must also review or investigate any matter brought to their attention regarding the Policy or the Law. If necessary, managers and supervisors must notify the director, work with him or forward certain questions to him.
Privacy Officer — The Privacy Officer will provide advice and direction to senior management and employees regarding the clinic’s handling of personal information. It will also serve as the first point of contact for people seeking information on the processing of their personal information by Prima Canada or having concerns in this regard.
Director — In addition to all of the above-mentioned responsibilities, the director of Prima Canada is required to appropriately apply the Personal Information Protection Act and policies relating to personal information and access to information.
Any violation of this policy, whether committed intentionally or negligently, may result in disciplinary action up to and including dismissal. Legal sanctions can also be taken, if necessary.
Monitoring and evaluation
Our internal audit program also includes verification of compliance with this policy. We conduct periodic audits of all our programs and services. The results of internal audits are transmitted to the director, as well as, to the person responsible for personal information.
Related Reference Materials
The following laws, policies and guidelines should be read in conjunction with this policy:
- Personal Information Protection Act and Implementing Regulations
- Access to information law and implementing regulations
- Library and Archives of Canada Act
- Privacy Policy
- Government Security Policy
- Privacy Practices Directive
- Directive on requests for personal information and correction of personal information
- Guideline on Privacy Practices — Appendix E: Web Analytics Privacy Standard
- Privacy Practices Directive — Appendix B: Mandatory Procedures for Privacy Breaches
Questions or complaints
Questions or complaints can be brought to the attention of any Prima Canada employee. If the employee cannot help, he or she should refer the matter to his or her immediate supervisor or a member of management.
If you have any questions about this policy or how we manage personal information, you can also contact:
Privacy Officer
C.M.I.P.Q
1665 Ste-Catherine Street West,
3rd floor, Montreal H3H 1L9
(514) 931-0801
When a person is dissatisfied with the measures that may have been taken by Prima Canada to correct the situation or with the explanations provided, they are informed of their right to file a complaint under the Personal Information Protection Act and receive instructions on the way to do it. Please note that we do not investigate whether our own measures comply with the Privacy Act. Any complaints on this subject are subject to an independent investigation by the Special Privacy Commissioner.