Developer:
Director of Finance
Effective Date:
January 2019
Last Reviewed:
January 2019

Category:
Domain:Human Resources
Operations
Subject Title:
Privacy and Confidentiality
Next Review:
Supersedes:
NEW
January 2020

Policy #:OPS-GA-HR-6.0
Approval:
Executive Director
Pages:
7

Rationale and Relationship to Mission, Principles and Values
 Momiji Health Care Society (Momiji) recognizes an individual’s right to privacy andis committed to maintaining the accuracy, confidentiality and security of thepersonal information in its custody. In pursuit of our mission, Momiji pledges totreat everyone with respect and dignity and protect their privacy.
 Momiji adheres to the highest standards of quality, transparency, and accountability.
To demonstrate this commitment, the organization has developed policies andprocedures about the collection, use and disclosure of information that align withfederal and provincial legislation and with industry standards.
Policy Objective
 This Policy acts as the articulation of Momiji’s privacy practices and standards
about the collection, use and disclosure of personal information and personal healthinformation in the course of its activities. It is intended to guide all staff, volunteers
and third‐parties who are given access to personal information in Momiji’s
possession.
 As used in this Policy, the term personal information is inclusive of personal healthinformation, unless the latter term is used exclusively. In that case, it applies only topersonal health information.
Policy Application
 This policy applies to volunteers and staff at all levels.
 In addition, Momiji requires that any individual or third‐party who collects, uses ordiscloses personal information on behalf of the organization complies with theprovisions of this policy in relation to the respective work.
Policy Details
A. Momiji property

Any and all records referred to in the document as being personal information or personal
health information are, and will remain the property of Momiji. Volunteers and staff are
required to maintain the privacy and confidentiality of all records in any and all formats
both while acting as an active volunteer or staff member and after they leave Momiji.

B. Compliance with relevant legislation

Momiji will comply with all applicable provisions of privacy legislation.

Federal and provincial privacy legislation
Momiji considers the Personal Information Protection and Electronic Documents Act(PIPEDA) ‐ the federal privacy law for private‐sector organizations ‐ the standard bywhich personal information should be protected. PIPEDA sets out the rules for how
business must handle personal information in the course of commercial activities. Most
Momiji activities are not “commercial activities” as defined by PIPEDA. One Momiji
activity that is regulated under the provisions of PIPEDA is “the selling, bartering or
leasing of donor, membership or other fund raising lists”; as from time to time, Momiji
exchanges donor lists (name and address only) with like‐minded organizations.

Personal health information legislation
Momiji is a health care custodian by law, it has adopted personal health information
legislation.

Canada’s Anti‐Spam Legislation (CASL)This policy supports Momiji’s compliance with Canada’s Anti‐Spam Legislation.
C. Personal and health information collected

To achieve its mission, Momiji collects certain personal information about its members,
donors, clients, event participants, staff and volunteers, meeting legal obligations and asotherwise permitted or required by law. Such information enables Momiji to deliver
programs and services, pursue government relations and advocacy initiatives, deliver public
education, fundraise, process donations, administer memberships, conduct marketing
efforts, undertake statistical reporting, etc.
Momiji collects the minimum amount of information needed to establish and maintain aservice, volunteer, participant, donor or program relationship with an individual. Subject tothe application of the consent principle outlined in Section 3 below, personal informationcollected by Momiji may include, but is not limited to:






Contact and identification information, such as name, address, telephone number
and email address;
A brief summary of the service requested and or received (programs and services
database);
Membership status and history (date when one became a member, current
membership status, etc.);
Participation in Momiji online campaigns and fundraising events;
Donation information such as date of gift, amount of gift, the campaign to which
one contributed;Financial information such as payment methods and preferences, billing andbanking information (credit card number and expiry date or chequing accounttransit numbers which are required to process a donation).
Other personal information used for purposes that a reasonable person would
consider appropriate in the circumstances.

D. Privacy and Confidentiality Principles

Momiji will abide by the following 10 principles when collecting, using and disclosing
personal information:
1. Accountability
Momiji is responsible for the personal information under its control.
 Momiji will designate an individual or individuals to ensure the compliancewith this Policy.
 Momiji will implement practices and procedures to carry out the policy,
including:
1. Implementing procedures to protect personal information;
2. Establishing procedures to receive and respond to complaints andinquiries from individuals regarding their personal information;
3. Training volunteers and staff and communicating to volunteers andstaff information about this Privacy and Confidentiality policy andpractices; and4. Developing information to explain its Privacy policy and practices.
2. Identifying Purposes
Momiji will identify the purposes for which personal information is collected. The
identified purposes will be specified at or before the time of collection to theindividual from whom the personal information is collected. When personal
information that has been collected is to be used for a purpose not previously
identified, Momiji is obligated to communicate the new purpose to each individualand obtain their consent to use the information.
3. Consent
The knowledge and consent of the individual are required for the collection, use, ordisclosure of personal information, except where consent is not required for very
specific reasons. It is anticipated that instances in which knowledge and consent of
the individual would not be required would be extremely rare and would include
legal, medical or security reasons which would have to be fully documented.
Consent is considered valid only if it is reasonable to expect that individuals towhom Momiji’s activities are directed would understand the nature, purpose andconsequences of the collection, use or disclosure, to which they are consenting.

1. Typically, Momiji staff and volunteers will seek consent for the use or
disclosure of the information at the time of collection. The form of theconsent sought by Momiji may be either express or implied, depending
upon the circumstances and the sensitive nature of the personal information.
2. Express consent is required from an individual before Momiji will disclose
personal health information about that individual to an external organization
or individual. Express consent can be provided verbally or in writing.
3. The provision of personal information to Momiji constitutes implied
consent to collect, use and disclose their personal information in accordancewith this policy, unless an individual expressly instructs otherwise.
Implied consent can also be inferred where there is an existing (i.e. past two
years) business or non‐business relationship between an individual andMomiji. Examples include but are not limited to a donor, a volunteer, amember, an event participant, a research grant applicant, someone who has
contacted Momiji for services, etc.
Implied consent is considered to be sufficient for fundraising purposes toallow the trade of limited personal information (name and home addressonly) about a donor to another charitable organization if the individual has
been informed that his/her personal information might be used in thismanner and he/she has been given an opportunity in a clear and meaningful
way to opt‐out.
Implied consent is also considered sufficient for relevant commercial
electronic messages (CEM) under CASL, provided the individual receiving
the message has interacted with Momiji in the immediate two‐year period the
day before the CEM is sent to the them, the sender clearly identifies
themselves and the CEM receiver has been given an opportunity in a clear
and meaningful way to opt‐out. Commercial electronic messages sent by
Momiji that have fundraising as the primary purpose are exempt from CASL.
4. No consent: There are certain activities for which consent is not required touse or disclose personal information. These activities are permitted or
required by law. For example, we do not need consent from individuals to(this is not an exhaustive list) respond to legal proceedings or comply withmandatory reporting obligations, investigations / fraud detection andprevention, witness statements in insurance claims, financial abuse, personal
information produced in the course of employment, business or profession,or other as identified by law from time to time.

5. Momiji may use or disclose your personal information without consent
where the Society believes, upon reasonable grounds, that it is necessary toprotect the rights, privacy or safety of an identifiable group or person(including you) or the public.
6. Withholding or Withdrawal of Consent: If consent is sought, an
individual may choose not to give consent (“withholding consent”). If
consent is given, an individual may withdraw consent at any time, but thewithdrawal cannot be retrospective. The withdrawal may also be subject tolegal or contractual restrictions and reasonable notice.
4. Limiting Collection
The collection of personal information will be limited to that which is necessary forthe purposes identified by Momiji. Information will be collected by fair and lawfulmeans.
5. Limiting Use, Disclosure and Retention
Personal information will not be used or disclosed for purposes other than thosefor which it was collected, except with the consent of the individual or as requiredby law. Personal information will be retained only as long as necessary for thefulfillment of those purposes.
Whenever possible, access to personal information will be limited to authorizedusers only. Personal information may only be used within the limits of each staff
and volunteer role. Staff and volunteers may not read, look at, receive or otherwise
use personal information unless they have a legitimate “need to know” as part oftheir position.
Personal information may only be disclosed within the limits of each staff /volunteer role. Staff and volunteers may not share, talk about, send to, or otherwise
disclose personal information to anyone else unless that activity is an authorizedpart of their position.
Personal health information that is no longer required to fulfill the identified
purposes will be destroyed, erased, or made anonymous safely and securely.
When Momiji discloses personal information to third‐party service providers withwhom it has a contractual relationship, the third‐party providers will only be given
access to personal information that is needed to perform the related function andmay not use it for any other purpose.
6. Accuracy
Momiji will take reasonable steps to ensure that personal information in its custodyis accurate, complete, and up‐to‐date as is necessary for the purposes for which it isto be used. Personal information that is used on an ongoing basis, including
information that is disclosed to third parties, will generally be accurate and up‐to‐date, unless limits to the requirement for accuracy are clearly set out. Individuals
will always have the opportunity to contact Momiji to update their personal
information.
7. Safeguards
Momiji will use appropriate security safeguards (depending on the sensitivity of theinformation) to protect personal information against loss or theft, as well as
unauthorized access, disclosure, copying, use, or modification, regardless of theformat in which it is held. Safeguards will include: physical safeguards (such as
locked filing cabinets and rooms); organizational safeguards (such as permitting
access to personal health information by staff on a "need‐to‐know" basis only); andtechnological safeguards (such as the use of passwords, encryption, and audits).
Momiji requires that any individual or third‐party who collects, uses or discloses
personal information on behalf of the organization complies with the provisions of
this policy. This will be done through the signing of confidentiality agreements,
privacy training and other contractual means.
Care will be used in the disposal or destruction of personal information, to prevent
unauthorized parties from gaining access to the information.
8. Openness
Information about Momiji privacy policies and practices relating to the managementof personal information will be available to the public, including:
0. Contact information for our Privacy Officer[s], to whom complaints orinquiries can be made;1. The process for obtaining access to personal information held by Momiji,and making requests for its correction;
2. A description of the type of personal information held by Momiji, including
a general account of our uses and disclosures; and3. A description of how an individual may make a complaint to Momiji.
4. Copies of any brochures or other information that explain Momiji’s policies,
standards, or codes.
9. Individual Access
If an individual requests, Momiji will inform them of the existence, use, anddisclosure of their personal information. The individual will be given access to that
information, will be able to challenge the accuracy and completeness of theinformation and have it amended as appropriate.
In certain situations, Momiji may not be able to provide access to all the personalinformation it holds about an individual. Exceptions to the access requirement will
be limited and specific. The reasons for denying access will be provided to theindividual upon request. Exceptions may include information that is prohibitively
costly to provide, information that contains references to other individuals,
information that cannot be disclosed for legal, security, or commercial proprietary
reasons, and information that is subject to solicitor‐client or litigation privilege.
10. Challenging Compliance
An individual will be able to address a challenge concerning Momiji’s compliancewith its own Privacy and Confidentiality Policy to the privacy officer.
Privacy officers will receive and respond to complaints or inquiries aboutorganizational policies and practices relating to the handling of personal
information as outlined in the Privacy Breach Management Procedures document.
They will inform individuals who make inquiries or lodge complaints of otheravailable complaint procedures.
Momiji will investigate all complaints. If a complaint is found to be justified, Momiji
will take appropriate measures to respond.