Personal Information Protection and Electronic Documents (PIPEDA)
PURPOSE
The Canadian Association of Chiefs of Police (CACP) recognizes the right of an individual to the protection of personal information and the need for information management practices that adhere to national standards.
It is the policy of the CACP to control the collection, use and disclosure of personal information in accordance with all requirements set out in the Personal Information Protection and Electronic Documents Act S.C. 2000, c. 5 (PIPEDA). PIPEDA does not apply to personal information that the CACP collects, uses or discloses only for journalistic, artistic or literary purpose.
The CACP is committed to the ten principles outlined in PIPEDA of:
- Accountability
- Identifying Purposes
- Consent
- Limiting collection
- Limiting use, disclosure and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
SCOPE
This policy will be applied to all personal information collected, used or disclosed, whether factual or subjective, about an identifiable individual during the course of all activities of the CACP, including commercial activities. It is the responsibility of the CACP to ensure that those individuals, groups/organizations and/or businesses that have been approved, designated or contracted to act for or on its behalf are aware of and in compliance with the principles set forth in this Privacy Policy.
PRIVACY CODE
Collection of Personal Information
Unless otherwise authorized by the PIPEDA:
1. No personal information shall be collected by the CACP unless it relates directly to an operating program or activity of the CACP;
2. The CACP shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom it relates except where the individual authorizes otherwise; and
3. The CACP shall inform any individual from whom it collects personal information of the purpose for which the information is being collected.
Retention of Personal Information
Personal information that has been used by the CACP for an administrative purpose shall be retained for such period of time after it is so used as may be prescribed by PIPEDA or its regulations in order to ensure that the individual to whom the information relates has a reasonable opportunity to obtain access to the information.
The CACP will retain information for only as long as is required to provide members with the services they are entitled to receive.
Purpose of Collection
The CACP collects personal information:
• To create internal reports;
• To create administrative records;
• To determine aggregate web usage levels;
• To provide members with the opportunity to provide feedback on the website and CACP programs, services and policies;
• To provide members the opportunity to utilize online resources;
• To provide members with information on CACP benefits, programs, services and policies;
• To communicate with members;
• To provide members with information on various topics; and/or,
• For the purposes for which the information was obtained or compiled.
The CACP will take all reasonable steps to document the purposes for which information is collected on its website.
Accuracy of Personal Information
The CACP shall take all reasonable steps to ensure that personal information that is used for an administrative purpose is as accurate, up to date and complete as possible.
Disposition of Personal Information
The CACP shall dispose of personal information under its control in accordance with PIPEDA or its regulations and with any guidelines issued by the designated Minister in relation to the disposal of that information and with its corporate retention schedule.
Use and Disclosure of Personal Information
Personal information under the control of the CACP shall not, without the consent of the individual to whom it relates, be used or disclosed by the CACP except for the purpose for which the information was obtained or compiled or for a use consistent with that purpose unless otherwise authorized by the PIPEDA.
When information is disclosed to third parties (subject to the consent of the individual to whom it relates or to an exception described in PIPEDA, the CACP shall use contractual or other reasonable means to ensure that third parties use a standard for the protection of personal information that is comparable to CACP privacy policies.
In certain circumstances personal information subject to PIPEDA may be used or disclosed without the knowledge or consent of the individual concerned. Such circumstances include, but are not limited to personal information used or disclosed:
• For the purpose for which the information was obtained or compiled by the CACP or for a use consistent with that purpose;
• For the purpose of complying with a subpoena or warrant issued or order made by a court, person or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of that information;
• To an investigative body specified in the regulations for the purpose of enforcing any laws or carrying out a lawful investigation;
• To officers or employees of the CACP for internal audit purposes;
• Where disclosure would clearly benefit the individual to whom the information relates.
Access to Personal Information
Upon receipt of a written request, the CACP shall provide a right of access to personal information subject to PIPEDA to:
• Any personal information about the individual requestor contained in a personal information bank; and/or
• Any other personal information about the individual requestor under the control of the CACP with respect to which the individual is able to provide sufficiently specific information on the location of the information as to render it reasonably retrievable.
Individuals who are given access to their personal information may:
• Request correction of the personal information where the individual believes there is an error or omission therein;
• Require that a notation be attached to the information reflecting any correction requested but not made;
• Require that any person or body to whom that information has been disclosed for use for an administrative purpose within two years prior to the time a correction is requested or a notation is required under this subsection in respect of that information;
• Be notified of the correction or notation, and/or
• Where the disclosure is to a government institution, the institution makes the correction or notation on any copy of the information under its control.
Refusal of Access to Personal Information
The CACP may refuse access to personal information as provided by PIPEDA where such information, among other circumstances:
• Is subject to solicitor client privilege;
• Is part of or relates to an investigative record where disclosure could be injurious to the enforcement of a law of Canada or a province or the conduct of an investigation; and/or
• Where disclosure threatens the safety of individuals.
Responsibility
All CACP employees who collect, maintain and/or use personal information, are responsible for ensuring that the collection, use and disclosure of this information is carried out in accordance with the police and relevant procedures.
The Privacy Officer (CACP Executive Director) is accountable for the CACP’s policies and practices with respect to the management of personal information and is the individual to whom complaints and inquiries can be forwarded.
Security
CACP websites have physical and technical measures in place to ensure the security of information. CACP websites use state of the art technology to safeguard data. CACP websites also use advanced encryption and firewall technology. Although the CACP will make every reasonable effort to protect personal information from loss, misuse, or alternation by third parties, internet users should be aware that there is always some risk involved in transmitting information over the internet.
Privacy on the Internet.
This privacy statement is applicable to all CACP websites.
The CACP respects the privacy of its internet users and will protect that privacy by all means necessary as required by PIPEDA.
The CACP does not collect information that personally identifies individuals except when individuals provide such specific information on a voluntary basis. In all such cases, the CACP will collect only information that is voluntarily provided by the user and undertakes that such information will be kept strictly confidential. Individual information provided to the CACP to gain access to any CACP site will not be sold or made available to a third party without consent.
The CACP does reserve the right to perform statistical analyses of user behavior and characteristics in order to measure interest in and use of the various sections of its sites so as to improve design and navigation and to gather marketing information. Only aggregated data from these analyses not individual data will be used for this purpose.
Users should be aware that certain non-personal information and data may be automatically collected
by the CACP through the operation of what are called “cookies”. “Cookies” are small text files that identify an individual computer’s browser entering a web site. They allow the site to track that
browser’s movement through the site over several sessions. Through cookies, a web site can recognize repeat users, facilitate the user’s access to and use of the site and allow a site to track usage behavior that will allow content improvements. The CACP uses cookies only for the above-mentioned purposes and will not sue them to identify users or to track non-CACP usage.