POLICY STATEMENT
RAC intends to protect the privacy of individuals concerning personal information it collects. RAC has set up effective systems to protect personal information about employees, suppliers, customers, members and other individuals to avoid unauthorized use or disclosure.
RAC will manage personal information in a responsible and business-like manner. RAC will see that the personal information it collects is to the extent possible accurate, kept up to date and protected from unauthorized use and disclosure.
APPLICATION
This policy applies to all RAC employees, individuals hired by RAC on a contractual basis, RAC suppliers and third parties in situations where they collect, process, have custody of and/or use personal information or design operating or functional policies and procedures, systems and forms that are instrumental in the collection, use and disclosure of personal information. People collecting, processing, using or disclosing personal information on behalf of the RAC shall by contract agree to respect this policy. The policy applies to personal information stored in any media (e.g. paper, magnetic tape, disk, microfilm and video).
DEFINITIONS
Personal information refers to any information about an identifiable individual, including but not restricted to:
- race, national or ethnic origin, colour, religion, age or marital status;
- medical (ex: blood type), educational, financial (ex: income or salary), employment information and criminal history;
- address, fingerprints and identifying numbers assigned to the individual (ex: social insurance number, employee number);
- correspondence with RAC that is explicitly or implicitly of a private nature;
- views or opinions of others about the individual (ex: evaluations, succession planning); and,
- the name of an individual, where disclosure of the name itself would reveal information about the individual.
It does not, however, include the name, title, business address or business telephone number, fax or email address of a RAC employee.
CONSENT
The consent to the collection, use or disclosure of personal information may be implicit or explicit, depending on the circumstances. In some cases, consent need not be in writing.
COLLECTION, USE, AND DISCLOSURE
COLLECTION
RAC shall only collect personal information that relates to RAC programs, activities, products or employment related matters.
Wherever possible, personal information to be used in decision making shall be collected directly from the individual to whom the information relates and such individuals shall be informed of the purpose of collection. The RAC should take steps to ensure personal information to be used in decision-making affecting an individual is as accurate, complete and up-to-date as possible.
Personal information already obtained by RAC shall be used and disclosed in a manner consistent with the purpose for which it was originally collected or in any other way the law does not prohibit.
The RAC might collect personal information indirectly or without consent and knowledge of the individual to whom it pertains in some circumstances, including when:
- The collection is clearly in the interests of the individual and consent cannot be obtained in a timely way; or
- It is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or accuracy of the information and the collection is reasonable for the purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or province.
USE AND DISCLOSURE
The RAC shall only use personal information or disclose it to third parties for a purpose for which the information was obtained or compiled, or for a use consistent with that purpose.
The consent of the individual shall be obtained before personal information is used or disclosed for any other purpose, unless the law otherwise permits the proposed use or disclosure.
The RAC might disclose personal information without the knowledge and consent of the individual to whom it pertains in some circumstances including:
- To a government institution for law enforcement purposes.
- To the RAC’s solicitor.
- For the purposes of collecting a debt owed to RAC by an individual.
- To comply with a subpoena or other court processes.
- In the event of an emergency that threatens the life, health or security of an individual.
RAC member representatives (including Associate Members) by giving their name, title, business address, business telephone number, fax or email, agree that they can be shared with other RAC member representatives.
HANDLING OF PERSONAL INFORMATION
Care must be taken when handling or transmitting personal information either internally or externally to avoid altering it. The method of transmission (whether by telephone, mail, fax, electronically or otherwise) must be appropriate to protect the confidentiality of the information in light of its sensitivity.
ACCOUNTABILITY
The Vice President is responsible for personal information under his control and shall be accountable for the compliance with this policy.
A person is appointed by the RAC to be responsible for monitoring application of the policy, providing training in personal information management, handling all matters relating to requests for access to personal information, developing personal information management procedures and guidelines, managing personal information complaints, adjudicating disputes related to personal information, and acting as a liaison, if need be, with the Federal Privacy Commission and the provincial equivalents.
ACCESS
Access to personal information shall be restricted to those who have a need for access in order to administer RAC programs or carry on RAC activities and to individual for information about themselves.
PERSONAL ACCESS
Unless denial of access is permitted by law, individuals have the right to access personal information on themselves for consultation or to ask for correction or annotation of such information.
In normal circumstances, RAC will respond to formal requests for access within 30 days of the receipt of a formal request. Individuals are invited to make informal request to the person they report to, before making a formal request.
A formal request is made by filing the required disclosure request and by submitting it to the RAC privacy coordinator.
The RAC can deny access to personal information in some circumstances including when:
- The information is protected by solicitor-client privilege.
- The information contains personal information about other individuals or active investigative records.
- To do so would reveal confidential commercial information.
- To do so would reasonably be expected to threaten the life or security of another individual.
- The information was collected for purposes related to investigating a breach of a contract, agreement, or a contravention of law.
- The information was generated in the course of a formal dispute resolution process
RETENTION AND DISPOSAL OF PERSONAL INFORMATION
Retention and disposal of personal information will be in accordance with retention schedules established and revised from time to time by RAC. In keeping with these schedules, personal information no longer required to fulfill the purposes for which it was collected should be destroyed.
RAC shall exercise care in the disposal or destruction of personal information to prevent unauthorized access to the information. When disposal of hard copy information is authorized, shredding must be used to maintain confidentiality.
RIGHT TO COMPLAIN
Individuals who believe their privacy or access-related rights have been breached are encouraged to raise the matter directly with the person concerned, their supervisor or the RAC privacy coordinator. In some cases, complaints may also be submitted directly with the Privacy Commissioner of Canada or provincial equivalents.
Please contact the following for any concerns regarding the website:
Sandra Kazaka
Vice President, Finance & Operations
Telephone: (613) 564-8089