CCAE Privacy Code
Introduction
The Canadian Council for the Advancement of Education (CCAE) is committed to fair information practices in relation to individuals whose information it collects, uses, retains and discloses in the course of its operations.
This Privacy Code outlines the principles and guidelines by which CCAE operates to protect the personal information of individuals that it collects, use, retains and discloses in the course of its operations, as subject to the provisions of the Personal Information Protection and Electronic Documents Act and applicable provincial privacy legislation.
This Privacy Code incorporates the 10 principles of the Canadian Standards Association Model Code on the Protection of Personal Information (CAN/CSA-Q830-96) which was published in March 1996 as a National Standard of Canada. It also incorporates the provisions of Part 1 of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5, and applicable provincial privacy legislation.
This Privacy Code does not apply to personal information about employees, former employees and potential employees (all referred to as “employees?) of CCAE.
Principle 1 – Accountability
CCAE is responsible for all personal information under its control, including personal information transferred to third parties for processing. CCAE has designated an individual who is accountable for the organization’s compliance with this Code.
Principle 2 – Identifying the purposes for personal information collection
CCAE will identify the purposes for which personal information is collected at or before the time the information is collected.
Principle 3 – Obtaining consent
CCAE will obtain the consent of individuals before or when it collects, uses, retains, or discloses personal information, except where authorized by law.
Principle 4 – Limiting the collection of personal information
CCAE will limit the collection of personal information to that which is necessary for the purposes identified by CCAE programs. CCAE will collect personal information by fair and lawful means.
Principle 5 – Limiting use, disclosure and retention of personal information
CCAE will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, or as required or as authorized by law. Personal information will be retained only as long as necessary for the fulfilment of those purposes.
Principle 6 – Keeping personal information accurate
CCAE will keep personal information as accurate, complete and up-to-date as necessary for the purposes for which it is to be used.
Principle 7 – Safeguarding personal information
CCAE will protect personal information with security safeguards appropriate to the sensitivity of the information.
Principle 8 – Being open about policies and procedures
CCAE will make readily available to individuals specific information about its policies and procedures relating to the management of personal information.
Principle 9 – Providing access to personal information
On written request, and subject to exemptions stipulated by law, CCAE will inform an individual of the existence, use, retention, and disclosure of their personal information and will provide access to that information. An individual will be entitled to challenge the accuracy and completeness of the information and have it amended where inaccuracies exist.
Principle 10 – Challenging compliance
A CCAE member will be entitled to address a challenge concerning compliance with the above principles to the CCAE Privacy Officer.
Privacy Code in Detail
Principle 1 – Accountability
CCAE is responsible for all personal information under its control, including personal information disclosed to third parties for processing.
1.1 The CCAE Privacy Officer is responsible for CCAE’s compliance with this Code, even though other individuals within CCAE may be responsible for the day to day collection and processing of personal information, and may be delegated to act on behalf of the CCAE Privacy Officer.
1.2 The identity of the individuals designated by CCAE to oversee compliance with this Code will be made known internally and will be made available externally on request.
1.3 CCAE will use contractual or other means to protect personal information that has been transferred to service providers for processing, storage, or other purposes consistent with CCAE’s core mandate purposes.
1.4 Where CCAE acts as a processor of personal information or as a service provider to others, CCAE will comply with this Privacy Code and any Privacy Statements issued by the CCAE program in question in respect of the personal information itcollects, uses, retains or discloses on behalf of third parties.
Principle 2 – Identifying the purposes for personal information collection
CCAE will identify the purposes for which personal information is collected, used or disclosed at or before the time the information is collected.
2.1 CCAE programs in accordance with this Privacy Policy will collect, use and disclose personal information for the following purposes:
2.1.1 to process and evaluate awards and fellowship applications, select awards and fellowship recipients and administer the fellowships once they are awarded;
2.1.2 to develop aggregate information and statistics in relation to awards programs;
2.1.3 to create and maintain the CCAE Membership Directory;
2.1.4 to market programs to potential participants, purchasers or sponsors;
2.1.5 to identify and offer information services and products to meet member needs or preferences;
2.1.6 to comply with legal requirements;
2.1.7 to respond to inquiries about programs received by telephone or by the CCAE web-site.
2.2 CCAE collects and uses primarily business names and addresses of members for purposes of marketing its programs and services to the educational advancement sector. CCAE collects from and discloses to third parties the names and mailing addresses of existing members. CCAE will require vendors of such information to represent that they have complied with applicable privacy legislation in disclosing this information to CCAE. CCAE will provide an opportunity to all members to consent to or opt-out of the collection, use and disclosure of their names and addresses for these purposes. (see section 3.7 below).
2.3 Individuals will be advised of the purposes for which the information is collected at or before the time information is collected. An individual may, at any time, request or be given an explanation of how their personal information is being used.
2.4 If CCAE proposes to use or disclose personal information for a purpose not previously identified, the new purpose will be identified and documented prior to the new use. Unless the new purpose is required or permitted by law, the consent of the individual will be obtained before the information can be used or disclosed for that purpose.
Principle 3- Obtaining consent
CCAE will obtain the consent of individuals before or when it collects, uses, retains, or discloses personal information, except where prohibited or authorized by law.
3.1 CCAE may collect, use or disclose personal information without the knowledge or consent of individuals. All of the circumstances in which CCAE may collect, use or disclose personal information without the knowledge or consent of an individual shall be only as specified and permitted by legislation.
3.2 In obtaining consent, CCAE will use reasonable efforts to ensure that an individual is advised of the identified purposes for which personal information will be used or disclosed. Purposes will be stated in a manner that can be reasonably understood by the individual and will be available through accessible means.
3.3 Generally, CCAE will seek consent to use and disclose personal information at the same time it collects the information. However, CCAE may seek consent to use and disclose personal information after it has been collected, but before it is used or disclosed for a new purpose.
3.4 CCAE will require individuals to consent to the collection, use or disclosure of personal information as a condition of the supply of information or services to the individual only if such collection, use or disclosure is necessary to provide the information or services.
3.5 In determining the appropriate form of consent, CCAE will take into account the sensitivity of the personal information and the reasonable expectations of individuals in relation to the purposes for use or disclosure of the information by CCAE.
3.6 An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Individuals may contact CCAE for more information regarding the implications of withdrawing consent.
3.7 Individuals may opt-out or refuse to consent to the use or disclosure of their personal information for marketing purposes by contacting CCAE at (613) 254-9696 or by writing to Privacy Officer, Canadian Council for the Advancement of Education, 232-329 March Rd, Box 11, Kanata ON K2K 2E1.
Principle 4 – Limiting collection of personal information
CCAE shall limit the collection of personal information to that which is necessary for the purposes identified by CCAE. CCAE will collect personal information by fair and lawful means.
4.1 CCAE collects personal information primarily from individuals directly.
4.2 CCAE may also collect personal information from other sources including:
4.2.1 Canadian educational institutions involved in advancement.
Principle 5 – Limiting use, disclosure and rentention of personal information
CCAE will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, or as required or authorized by law. Personal information will be retained only as long as necessary for the fulfilment of those purposes.
5.1 CCAE may disclose personal information about an individual to the following for the purposes set out in Section 2:
5.1.1 a person who, on the basis of a written authorization from an award applicant or recipient, is seeking the information as an agent of the applicant or recipient;
5.1.2 to a third party, where the individual consents to disclosure or where disclosure is required or authorized by law.
5.2 All personal information is accessible only by CCAE’s personnel, or service providers, who need access to that information for the performance of their duties or services.
Principle 6 – Keeping personal information accurate
CCAE will keep personal information as accurate, complete and up to date as necessary for the purposes for which it is to be used.
6.1 Information will be sufficiently accurate, complete and up to date so as to minimize the possibility that inappropriate information may be used to make a decision about an individual.
6.2 CCAE will update personal information about individuals on an on-going basis, only when necessary to fulfill the purposes identified in this Code, or upon notification by the individual.
Principle 7 – Safeguarding personal information
CCAE will protect personal information with security safeguards appropriate to the sensitivity of the information.
7.1 CCAE will protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held, using appropriate security safeguards.
7.2 CCAE shall protect personal information transferred to third parties providing services to CCAE through contractual measures or other arrangements stipulating the confidentiality of the information, restricting the purposes for which the information is to be used and prohibiting its disclosure to third parties upon direction from CCAE in accordance with this Privacy Code.
Principle 8 – Being open about policies and procedures
CCAE will make readily available to individuals specific information about CCAE policies and procedures relating to the management of personal information.
8.1 CCAE will be open about its policies and procedures with respect to the management of personal information. Individuals will be able to acquire information about its policies and procedures at minimal or no cost and without unreasonable effort. This information will be made available in a form that is generally understandable.
Principle 9 -Providing access to personal information
On written request, and subject to the exemptions stipulated by law, CCAE will inform individuals of the existence, use and disclosure of their personal information and provide access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended where inaccuracies exist.
9.1 In certain situations, CCAE may not be able to provide access to all of the personal information that it holds about an individual. These situations shall be limited to those required or stipulated by law.
9.2 When an individual successfully challenges the accuracy or completeness of personal information, the CCAE will correct, delete or add information as required. When appropriate, the amended information will be transmitted to any third parties having access to the information in question.
Principle 10 – Challenging compliance
An individual will be able to address a challenge concerning compliance by CCAE with this Code to the CCAE Privacy Officer.
10.1 CCAE will implement procedures to receive and respond to complaints or inquiries about its policies and procedures relating to the handling of personal information.
10.2 CCAE will investigate all complaints. If a complaint is found to be justified, CCAE will take appropriate measures, including amending its policies and procedures if necessary.
10.3 Individuals will be able to obtain more information on CCAE’s privacy practices, or make a complaint, by contacting:
Privacy Officer
CCAE National Office
The Woolen Mill
4 Cataraqui Street, Suite 310
Kingston, ON K7K 1Z7 Canada
613-531-9213
admin@ccaecanada.org
10.4 Individuals also have recourse to the Office of the Privacy Commissioner of Canada if they consider that CCAE has not responded satisfactorily to their complaint or inquiry.
Privacy Commissioner of Canada
112 Kent Street
Ottawa, Ontario K1A 1H3
Phone: (613) 995-8210
Toll-free: 1-800-282-1376
Fax: (613) 947-6850
http://www.privcom.gc.ca/index_e.asp
For a copy of the Personal Information Protection and Electronic Documents Act, please access the web site of the Privacy Commissioner of Canada at www.privcom.gc.ca.
The CSA Model Code is Schedule 1 to the Personal Information Protection and Electronic Documents Act. For copies of the CSA Model Code for the Protection of Personal Information, please contact:
Canadian Standards Association
178 Rexdale Blvd.,
Etobicoke, Ontario M9W 1R3.