New Urban Registry has adopted this Personal Information Protection Policy in compliance with the provincial privacy law Personal Information Protection Act (PIPA).The protection of your personal information is important to us. We are committed to protecting the privacy of our employees. This policy sets out how we collect, use and disclose the personal information of our employees, including applicants applying for a job. Our commitment is to maintain the confidentiality of your personal information and to preserve your right to privacy.Employees are obligated to ensure that personal information to which they may have access (whether for other employees or clients) remains confidential and is only used for the purposes for which it was collected is not disclosed without authorization or used for personal gain.Employees are required to follow all procedures regarding collection, use and disclosure of personal information as set out in this policy.The Office Manager is accountable for compliance with this policy.
The purpose of this is to preserve the privacy of employees and clients by outlining employee obligations and procedures for dealing with personal, privileged and/or confidential information.All employees of New Urban Registry, who receive personal, privileged and/or confidential information which may concern other employees, company operations or clients/customers; and who collect, maintain and/or use personal information of employees, are responsible for ensuring that the collection, use and disclosure of this information is carried out in accordance with this policy and relevant procedures.In certain circumstances, personal information may be collected, used, or disclosed without the knowledge and consent of the individual. Exemptions include, but are not limited to, personal information gathered for: Legal, medical, or security reasonsDetection and prevention of fraud or for law enforcementJournalistic, artistic or literary purposes if its use is confined to those purposes
This policy describes the minimum requirements for the protection of employee personal information. Any applicable legislation must be considered in implementing these requirements.This policy applies to all employees or anyone else who is granted access to personal, privileged and/or confidential employee and/or client information.
The term “personal information” is defined as factual or subjective information, recorded or not, about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.The following definitions apply in this policy:“Personal Information” means recorded information about an identifiable individual which includes, but is not limited to, home addresses and telephone numbers, age, gender, marital or family status, identifying numbers such as social insurance number and driver’s licence, race, national or ethic origin, colour, religious or political beliefs or associations, educational history, medical history, disabilities, blood type, employment history, financial history, criminal history, anyone else’s opinions about an individual, an individual’s personal views or opinions, and name, address and phone number of parent, guardian, spouse or next of kin.“Collection” means the act of gathering, acquiring, or obtaining personal information from any source, including third parties, by any means.“Consent” means a voluntary agreement with what is being done or proposed. Consent can either be express or implied. Express consent is given explicitly, either orally, or in writing. Express consent is unequivocal and does not require any inference on the part of the organization seeking consent. Implied consent arises where consent may reasonably be inferred from the action, or inaction, of the individual.“Disclosure” means making personal information available to others inside and/or outside the organization.“Use” means the treatment and handling of personal information by, and within the company.
“Educational history” means courses, grades, grade point average, academic status, graduation status, other institutions attended, admission status, course schedule and course registration status.
“Financial history” means information about income, employee’s finances, assets, salaries, wages, monetary incentives, beneficiaries, insurance, benefits, financial transactions, creditworthiness and debts.
“Employment history” means personal recommendations or evaluations, character references or personnel evaluations, letters of discipline and reprimand and reasons for termination.
“Medical history” means health care history relating to medical, psychiatric, or psychological diagnosis, condition, treatment, or evaluation.
“Personal health information” means information about an identifiable individual that relates to the physical or mental health of the individual, the provision of health care to the individual, the individual’s entitlement to payment for health care, the individual’s health care number, the identity of providers of health care to the individual or the identity of substitute decision-makers on behalf of the individual.
“Law enforcement” means disciplinary investigations or proceedings that lead or could lead to a penalty or sanction being imposed and policing.
“Third Party” means individuals or organizations other than the subject of the records or representatives of New Urban Registry. Note that in certain circumstances, the company may be entitled to provide personal information to an external party acting as an agent of New Urban Registry.
Employees are responsible for:
- Keeping their own employee files current regarding their personal information;
- Being familiar with and following policies and procedures regarding personal, privileged and/or confidential information;
- Obtaining the proper consents and authorizations prior to disclosure of personal, privileged and/or confidential information;
- Immediately reporting any breaches of confidentiality to the Office Manager
- Keeping private passwords and access to personal information privileged and confidential;
- Explaining this policy to clients and referring them to the Office Manager if necessary;
- Relinquishing any personal, privileged and/or confidential information in their possession before, or immediately upon, termination of employment.
- LEGAL REQUIREMENTS
New Urban Registry is responsible for personal information under its control and designates the Office Manager as Privacy Coordinator who is accountable for New Urban Registry’s compliance with the Act and all privacy requirements.Identifying Purposes
The purposes for which personal information is collected shall be identified by New Urban Registry at or before the time the information is collected.Consent
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information.Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by New Urban Registry.Limiting Use, Disclosure and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as permitted by law. Personal information will be retained only as long as necessary for the fulfilment of those purposes.Accuracy
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
New Urban Registry shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
Upon request, an individual shall be informed of the existence, use, disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
An individual shall be able to address a challenge concerning compliance with the above principles to the Office Manager, who is accountable for New Urban Registry’s compliance.
This Personal Information Protection Policy addresses two broad issues:
- The way in which New Urban Registry collects, uses, discloses and protects personal information as well as privileged and confidential information.
- The right of employee’s or third party to have access to personal information, and if necessary, to correct the information.
Collecting, Use and Disclosing Information
- Information Collected New Urban Registry collects uses and discloses employee personal information in order to establish, manage, or terminate an employment relationship.Personal, privileged and/or confidential information about customers/clients may only be collected, used, disclosed and retained for the purposes identified by New Urban Registry as necessary.
- Withdrawal of Consent You may withdraw your consent subject to legal or contractual obligations and on reasonable notice.If you want to withdraw your consent, you should first contact the Office Manager to understand the implications of such withdrawal, and then if you choose to proceed, to give the requisite notice.
- Access to Personal Information Other employees who have access to your personal information are made aware of how to keep it confidential. Employee access to confidential information about applicants, employees or former employees, including others paid through the company’s payroll system where the company has custody or control of information will be allowed if the information is necessary for the performance of the duties of the employees. All employees of New Urban Registry are bound by this policy and a Confidentiality Policy. We must as adhere also to a Code of Conduct.An employee’s supervisor, higher-level managers, human resources and payroll personnel shall have access to employee records containing personal information. An employee’s supervisor, higher-level managers, human resources and payroll personnel will have access to an employee’s personal health information if the privacy manager determines that such access is permissible and necessary.Employees may request access to review their own file by making arrangements with the Office Manager. Employees shall provide at least twenty-four hours written notice to the Office Manager. We will respond to your request within 30 days or advise you additional time is required to respond to your request.Employees may obtain a copy of any document in their file which they have previously signed. No material contained in an employee file may be removed. A representative of the company will be present during viewing of the file.There may be situations in which we are legally prohibited from allowing you access to your personal information. For example, we would be so prohibited if allowing you access to your personal information would likely reveal personal information about another person or other confidential information. If this is the case, we will advise you why, subject to any legal restrictions. Other exceptions are as follows:
Evaluating information collected in a reference check if the disclosure reveals the identity of the information source, and the source expected that his or her identity would be held in confidence (this information is retained in another file rather than in the employee file); and information that would disclose personal information about another party.
The right of access does not extend to information exempted from disclosure under PIPA but if that information can reasonably be severed from a record an applicant has the right of access to the remainder of the record.
The right of access to a record may be subject to the payment of any fee required according to company policy or procedure for informal or formal access request. However, we will only do so after first advising you of the approximate cost. (optional)
Correcting Personal Information
You have a right to submit a written request to access your personal
information that is in our possession and make corrections to it. An employee can request a correction to his or her personal information if
there is an error omission or, alternatively, he or she may require that a statement of disagreement is attached. We will amend personal information that is demonstrated to be inaccurate or incomplete.
An employee may provide written notice of correction related to any data contained in the employee’s file. The notice of correction shall be provided to the Office Manager.
Client information is only be accessed by employees with appropriate authorization.
New Urban Registry will not disclose personal information about applicants or employees to any third party unless it is otherwise provided for by employee explicit consent or by law.
Employees must ensure that no personal, privileged and/or confidential information of clients is disclosed without the client’s consent and then only if security procedures are satisfied.
Access to Third Party Personal Information by Employees or About Employees
We do not make any employee personal information available to other organizations without your expressed consent, except under the following circumstances:
- If the employee has given consent
- If the information is required for the purpose for which it was obtained
- If required by law such as reporting an employee accident to the Worker’s Compensation Board of a province or to a law enforcement agency
- In compelling circumstances under which a delay in obtaining information may be injurious to an individual’s health and safety; and
- In compassionate circumstances in order to facilitate contact with next-of-kin or a friend of an individual who is injured, ill or deceased.
Employee requests for disclosure of their own personal information to third parties
Employee requests for disclosure of their own personal information to third parties must be accompanied by a completed signed and dated Authorization to Release Information form. This form should be used in dealing with insurance companies with respect to employee benefits and to provide confirmation of earnings to financial institutions for lending purposes.
If an organization contacts the company for reference information on an employee or former employee of the company, the information is only disclosed if the organization has a written authorization of the employee.
Requests regarding third party access to employee personal information will be handled by the Office Manager of New Urban Registry and must be in writing.
Access will be administered according to those specific policies and procedures, which may be established from time to time by the Company to apply to the personal information of employees.
Information Protection Measures
We have developed and continue to enhance security procedures to safeguard and protect personal information against loss, theft, unauthorized disclosure, copying, and unauthorized use or modification.
We maintain appropriate safeguards and security procedures that reflect the types of documents including electronic or paper records. Organizational measures taken include security clearances and limiting access on a “need-to- know” basis. Technological measures include the use of passwords and encryption.
Retention/Destruction of Personal Information
- We keep your personal information only as long as we need it to administer the employment relationship and services, and for a reasonable time thereafter, or to meet any legal, regulatory, or tax requirements.
- Unless retention of personal information is specified by law for certain time periods, personal information that is no longer required to fulfil the identified purposes shall be destroyed, erased or made anonymous within a reasonable time after its issue.
- We destroy your personal information when it is no longer needed, or we remove your name from the information.
- Notwithstanding the above, personal information that is subject of a request by an individual or a Privacy Commissioner shall be retained as long as necessary to allow individuals to exhaust any recourse they may have under federal and/or privacy legislation.
FURTHER INFORMATION AND CONTACT
You can obtain further information about our Personal Information Protection Policy by contacting our Office Manager.
If you have a question or complaint regarding our privacy policies or procedures, you may contact our Office Manager.
If your concern remains unresolved to your satisfaction, you may address your concerns to the Privacy Commissioner of Canada, 112 Kent Street, Ottawa, Ontario, K1A 1H3 or the Privacy Commissioner of Alberta, Suite 2460, 801 6 Avenue SW, Calgary, Alberta, T2P 3W2.
No employee shall be disadvantaged or denied any benefit of employment by reason that New Urban Registry believes that an employee will do anything referred to paragraphs (a), (b) or (c) below or by reason that he or she, acting in good faith and on the basis of reasonable belief that he or she has:
- disclosed to the Privacy Commissioner that New Urban Registry or any other person has contravened or intends to contravene a provision of any privacy legislation related to the protection
- refused or stated the intention of refusing to do anything that is in contravention of a provision of any privacy legislation related to the protection of personal information.
- done or started an intention of doing anything that is required to be done in order that a provision of any privacy legislation related to the protection of personal information not be contravened.
Breach of Company Policy
An employee who is found to be in breach of this policy will be subject to discipline up to and including discharge for cause.