Source: http://docplayer.net/19874730-Personal-information-protection-and-electronic-documents-act.html
Timestamp: 2020-07-06 11:44:21
Document Index: 186954989

Matched Legal Cases: ['ART 1', 'ART 2', 'art 1', 'art 2', 'art 2', 'art 1', 'art 2', 'ART 1', 'art 2']

Personal Information Protection and Electronic Documents Act - PDF Free Download
Download "Personal Information Protection and Electronic Documents Act"
1 PIPEDA Self-Assessment Tool Personal Information Protection and Electronic Documents Act
2 table of contents Why this tool is needed... 3 How to use this tool... 4 PART 1: Compliance Assessment Guide Principle 1 Accountability... 6 Principle 2 - Identifying Purposes Principle 3 Consent Principle 4 Limiting Collection Principle 5 Limiting Use, Disclosure, and Retention Principle 6 Accuracy Principle 7 Safeguards Principle 8 Openness Principle 9 Individual Access Principle 10 Challenging Compliance PART 2: Diagnostic Checklists Introduction Interpreting Self-Assessment Results Action Planning Checklist for Principle 1 Accountability Supplemental Assessment for Federal Works, Undertakings or Businesses Checklist for Principle 2 Identifying Purposes Checklist for Principle 3 Consent Checklist for Principle 4 Limiting Collection Checklist for Principle 5 Limiting Use, Disclosure, and Retention Checklist for Principle 6 Accuracy Checklist for Principle 7 Safeguards Checklist for Principle 8 Openness Checklist for Principle 9 Individual Access Checklist for Principle 10 Challenging Compliance Appendix A Appendix B Appendix C... 53
3 Why this tool is needed In a world of ubiquitous computing and information sharing it is increasingly difficult to ensure appropriate use and protection of personal information. Strong privacy governance and management within organizations are effective means of mitigating privacy risks and ensuring that fair information principles are applied in business decisions and day to day operations. The Office of the Privacy Commissioner of Canada (OPC), has developed this self-assessment tool to help medium and large organizations develop and implement good privacy governance and management. Privacy self-assessment is a process whereby an organization initiates an evaluation for the purpose of benchmarking and improving its own privacy systems and practices over time. This includes assessing the organization against a set of expectations to determine the degree to which they are met. In measuring compliance, gaps and/or risks may be identified for the purpose of guiding and following up remedial action. The OPC views self-assessment by organizations as an efficient and effective means of promoting privacy principles. See Annex B for more details. This tool is offered to guide you in evaluating and improving your personal information management systems and practices. It is designed for medium to large private sector organizations which are subject to Canada s Personal Information Protection and Electronic Documents Act (PIPEDA), but may be adapted and used by others wishing to apply PIPEDA principles. Use of this tool is voluntary. How you achieve compliance with PIPEDA is your responsibility. Nothing in this consultation document should be considered to interfere with or fetter the discretion of the OPC to carry out its responsibilities, especially with respect to any complaint filed by an individual under PIPEDA or the Privacy Act or the undertaking of an audit by the OPC under either Act. What this tool is A set of standards that medium to large businesses can use to monitor compliance with the 10 Fair Information Principles from Schedule 1 of PIPEDA 1 ; A framework of principles and criteria to assess the degree to which your business is compliant with your obligations; and A means of interpreting results and creating an action plan for improving your personal information management practices or checking the adequacy of practices already in place. What this tool is not A one-size fits all application; A replacement for tried and true assessment methods you may have already developed and implemented; Definitive and all-inclusive for all organizations; A replacement or substitution for PIPEDA; or Relevant for legislation other than PIPEDA. 1 These ten principles are: Accountability, Identifying Purpose, Consent, Limiting Collection, Limiting Use Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 3
4 How to use this tool This tool is made up of two parts, both of which are described in more detail in later sections: Part 1: A compliance guide, which will help inform you of your obligations under PIPEDA, and; Part 2: A diagnostic tool, which is a series of checklists you can use to assess how compliant your business (overall or parts thereof) is with the 10 Fair Information Principles of PIPEDA. Use both sections together to ensure you understand whether you meet your privacy objectives, to what degree each objective is met, and the evidence that can be used to demonstrate compliance. Comments on this publication should be sent to the attention of the Director General of Audit & Review, Office of the Privacy Commissioner of Canada, 112 Kent Street, Ottawa, Ontario, K1A 1H3. This tool can help you at various stages in your organization s developmental needs. It can be adapted for application to your organization as a whole or to particular business units as you may choose. If you do not have an established privacy program, you can use it to identify the various privacy controls (policies, systems, procedures, access controls, etc.) that need to be designed and implemented within your organization. After these controls have been implemented and operating for a certain period of time, use the checklists to conduct a thorough self-assessment to identify gaps and areas for improving personal information management practices. Next steps: If you are: A medium to large organization with an established privacy framework which addresses all 10 Fair Information Principles of PIPEDA, we suggest you proceed directly to the checklists in Part 2 to assess your compliance. A medium to large organization without an established privacy framework which addresses the principles of PIPEDA, we suggest you proceed to the compliance guide in Part 1 to begin understanding your obligations under the legislation. A medium to large organization with a privacy framework and some policies, but you aren t sure if they address PIPEDA requirements, we suggest you proceed to the checklists in Part 2 to assess your compliance. Completing the checklists will allow you to identify gaps in your privacy framework. For Further Reference Appendix A contains an overview of PIPEDA. This self-assessment tool should be used in conjunction with the Act. It does not replace, substitute, or override the Act in any way. Appendix B outlines the concept, benefits, and how an organization may set about doing a self-assessment. Appendix C lists other guidance available from the OPC. We suggest consulting the OPC Web site at where you will find additional guidance on a variety of compliance matters. We also encourage organizations to review complaint case summaries published by the OPC to learn about how the OPC may interpret PIPEDA as well as to gain insight on systemic causes of privacy compliance problems. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 4
5 PART 1: Compliance Assessment Guide Introduction Each section of this guide describes one of the 10 Fair Information Principles which form the basis of a privacy standard to evaluate compliance with PIPEDA. In order to ensure your personal information handling policies and practices are compliant, you should address the criteria associated with each principle. For each of the 10 principles, the guide includes two types of information: Description of your specific responsibilities for personal information management under the principle being addressed based on PIPEDA; and Activities and best practices that enable you to meet each compliance obligation. As these are examples only, you may need to adapt them or choose unique ways to implement requirements. The Compliance Guide will help you in developing the elements of your privacy framework. Once you have developed your framework and it has been up and running for some time, complete the self-assessment checklists in Part 2 to ensure that it is operating as it should. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 5
6 Principle 1 Accountability An organization is responsible for the personal information under its control and shall designate an individual or individuals who are accountable for the organization s compliance with the following principles. Your Organization s Privacy Responsibilities Under the Accountability principle, your organization must: Accept responsibility for personal information under its control; Designate at least one representative to be accountable for the organization s compliance with the 10 principles set out in Schedule 1 of PIPEDA; Make the identity of the designated individual(s) known on request; Protect all personal information in the organization s possession or custody, including information that has been transferred to a third party for processing; Use contractual or other means to ensure a comparable level of protection while personal information is with a third party for processing; Develop and implement policies and practices to uphold the 10 principles set out in Schedule 1 of PIPEDA including: Implementing procedures for protecting personal information; Establishing procedures for receiving and responding to complaints and inquiries; Training staff and communicating information to staff about the organization s policies and practices; and Developing information to explain the organization s policies and procedures. Under the Accountability principle, your organization may: Delegate other individuals within the organization to act on behalf of the designated privacy representative. How to Meet these Objectives Designate a Privacy Representative Appoint at least one person in the organization to be accountable for your organization s personal information handling policies and practices. If this individual is not a dedicated Privacy Officer, ensure that the job description for this person includes responsibility for controlling personal information, as required by law. This person should: be a senior decision maker who is clearly supported in his/her role by senior management in promoting privacy as a corporate value; be able to intervene on privacy issues across the organization when needed; and be expected to ensure that sufficient and appropriate resources are allocated for implementing privacy policies, managing privacy risks, and ensuring periodic assessments are done to see if privacy policies are being met and the organization is complying with PIPEDA. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 6
7 Where appropriate, publish the name or title and business address of the privacy officer internally and externally (e.g., on Web sites and in company literature). Be prepared to identify your privacy officer should you receive a request for this information; and Develop guidance that will assist staff in responding to questions from customers about your Privacy Program, including information on how to contact the Privacy Officer if they request it. Develop Privacy Policies and Procedures 2 Develop and implement personal information-handling policies and procedures corresponding to specific principles in Schedule 1 of PIPEDA. If your organization is a federal work, undertaking, or business, as defined in Section 2(1) of PIPEDA, these policies and procedures apply to the personal information of your employees as well as your customers; Define a privacy policy that will apply to the whole organization, augmented by sub-policies that apply to specific business areas, if required; Articulate procedures for: Informing individuals of the purposes for collection ( Principle 2 - Identifying Purposes); Obtaining appropriate consent ( Principle 3 - Consent); Allowing individuals to withdraw consent ( Principle 3 - Consent); Limiting the collection of personal information (in both amount and type of information as well as without misleading or deceiving individuals) to that which is necessary for purposes identified and ensuring it is collected by fair and lawful means (Principle 4 Limiting Collection). Retaining and destroying personal information ( Principle 5 - Limiting Use, Disclosure, and Retention); Ensuring that information is correct, complete, and up-to-date ( Principle 6 - Accuracy); Ensuring adequate security measures ( Principle 7 - Safeguards); Making information on policies and practices available to the public ( Principle 8 - Openness); Receiving and processing access requests ( Principle 9 - Individual Access); Receiving and responding to inquiries and complaints ( Principle 10 - Challenging Compliance). Define administrative policies for privacy governance and management setting out expectations regarding: Organizational structures, roles and responsibilities to achieve privacy requirements; Reporting to Senior Management on privacy policy and risk management procedures; Allocation of sufficient and appropriate resources to implement and support privacy policies; Requirements to undertake privacy impact assessments before new products, services or information systems are introduced or existing ones are significantly changed; Information security and management standards to ensure that information is safeguarded against unauthorized disclosure, modification, interruption, removal or destruction; Requirements for periodic review of the design, acquisition, development, implementation, configuration and management of the infrastructure, systems, applications, and Web sites to ensure consistency with privacy policies and procedures; Requirements for identifying, assessing and reporting on the impact of, and correcting the cause of, privacy breaches including loss of personal information or inappropriate use of personal information; Procedures to follow in responding to privacy complaints and undertaking corrective actions as required; Ongoing privacy training for employees; and Auditing for compliance with good privacy management practices. 2 Your privacy framework may be comprised of a single, overarching policy or a suite of smaller policies, all of which support the 10 principles. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 7
8 Ensure Accountability of Organization and Staff Give your privacy officer senior management support and the authority to intervene on privacy issues relating to any of your organization s operations and reflecting the addition of privacy responsibilities by updating the formal job description; Make sure your organization s privacy officer can: demonstrate knowledge of the organization s personal information handling policies and procedures; demonstrate knowledge of the organization s responsibilities under PIPEDA; explain the procedures for requesting personal information and filing complaints; and conduct or supervise complaint investigations. Train all front-line and management staff and keep them informed, so that they: can either respond to inquiries about your organization s privacy policies and practices themselves or refer inquirers to the privacy officer or another authorized representative; can explain the organization s purposes for collecting personal information; understand your organization s policy and procedures on consent and can obtain consent as appropriate; explain to customers when and how they may withdraw consent and what consequences if any may come of such withdrawal; can recognize and process requests for access to personal information; can refer complaints about privacy matters to the organization s privacy officer; and are up to date on your organization s ongoing activities and new initiatives relating to the protection of personal information. Ensure that you: keep your employees informed of new privacy issues raised by technological changes, internal reviews, public complaints, and decisions of the courts on a day-to-day basis; and develop and implement a system to monitor your organization s compliance with PIPEDA on an ongoing basis. Disseminate Information to the Public Customers are becoming more aware of privacy issues and the protection of personal information. You should communicate your policies and practices for collection and use of personal information and the steps you take to protect their personal information. To that end: Develop and disseminate literature (i.e., brochures, booklets, Web sites, or other written materials) to explain, in plain language, your organization s privacy policies, practices, and procedures to customers and the general public; Make sure that any such literature clearly specifies how individuals may: obtain access to their personal information; correct their personal information; make inquiries about the organization s privacy policies or practices; and complain about the organization s privacy policies or practices. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 8
9 For customers in particular, make it easy to find out whom in the organization to contact in order to: make general inquiries regarding their personal information; request access to their personal information; and correct their personal information. Responsibility for Third Party Transfers Organizations transfer information to third parties for processing for a variety of reasons. It is important to note that the original organization retains control of the information when transferring personal information to a third party for processing. Best practices include: Using privacy protection clauses in contracts to ensure that third parties to which personal information is transferred for processing provide the same level of protection under PIPEDA as your organization does, unless the third party is a subsidiary or an affiliate bound by the same privacy code; Ensuring that the third party: names a person to handle all privacy matters relating to the information transferred; limits its use of the information to purposes authorized by your organization; limits disclosure of the information to what is authorized by your organization or required by law; refers to your organization any access requests or complaints relating to the information transferred; uses appropriate security measures to protect the personal information; returns or securely disposes of the transferred information upon completion of the contract; and reports on the adequacy of its personal information security/control measures and allows your organization to audit its compliance as necessary. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 9
10 Principle 2 - Identifying Purposes The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected. Your Organization s Privacy Responsibilities Under the Identifying Purposes principle, your organization must: Identify why it is collecting personal information at or before the time of collection; Document its purposes for collecting personal information; and Notify your clients or customers before using personal information for any purpose not identified at the time of collection. Under the Identifying Purposes principle, your organization should: Determine the amounts and types of information needed to fulfill the purpose you collected it for, in accordance with the Limiting Collection principle; and Ensure that anyone who collects personal information for the organization can explain why to your clients and customers. Under the Identifying Purposes principle, your organization may: Choose how best to explain to your clients and customers why their personal information is being collected, either orally or in writing. Notes The Identifying Purposes principle relates closely to the knowledge requirement set out in the Consent principle. Specifically, Principle of Schedule 1 states: The principle requires knowledge and consent. Organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. Subsection 5(3) of PIPEDA is also relevant: 5(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 10
11 How to Meet these Objectives Identify Purposes Review your current practices, and determine the specific purposes for collecting personal information; New purposes should be reviewed by the Privacy Officer to determine if they are appropriate, and to consider and mitigate any potential privacy risks stemming from the new uses; Determine the amounts and types of information your organization minimally needs to collect in order to fulfill its purposes, keeping the Limiting Collection principle in mind; Confirm that the reasons you re collecting personal information are what a reasonable person (e.g., a typical customer) would expect or consider appropriate in normal business circumstances, in keeping with Section 5(3) of PIPEDA (see note above); and Clearly distinguish between collection activities that are essential and those that are not to the actual provision of the products or services customers have requested, such as marketing additional products or services. Customers should be able to opt out of non-essential or secondary purposes. Document Purposes Clearly record in writing all the reasons why you collect personal information. Keep this list up-to-date. When compiling your list: Be specific about your intended uses and disclosures of personal information; Do not use broad categories of purposes such as serving the customer ; Avoid vague or open-ended language such as and other uses as appropriate ; and State why you collect personal information in clear, concrete and unambiguous terms, so that customers will be able to understand the specific ways in which your organization intends to use or disclose the information it collects from them. To comply with the Openness principle, incorporate these purpose statements in your organization s privacy literature and other relevant documents (e.g., terms of agreement, application forms). Specify Purposes Wherever practicable and reasonable, notify clients and customers, orally or in writing, why you are collecting personal information before you collect it; Where notification at or before collection is not practicable or reasonable, notify clients and customers, orally or in writing, before using or disclosing the information; As a general rule, notify after collection only if the purposes are new (i.e., not yet conceived at the time of collection); In general, before obtaining consent, make every reasonable effort to inform customers of the purposes for which your organization intends to use or disclose their personal information. Keep in mind that their meaningful consent will ultimately depend on their knowledge of what they are consenting to; and Inform customers of any intended uses or disclosures of their personal information that they would not reasonably expect when obtaining a product or service from your organization. This includes sharing personal information with third-party marketers. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 11
12 When You Specify Purposes Orally Train employees who collect personal information so that they are able to explain purposes accurately, clearly, and consistently, and inform them of any new reasons for collection; Provide a standard script or use other means to ensure that all staff can explain such purposes to customers in a clear and consistent manner; and If your organization records telephone calls with customers (e.g., for quality control purposes), make a practice of informing the customer of this practice and its purposes at the beginning of every call. Refer to the OPC document Guidelines for Recording Customer Telephone Calls available at When You Specify Purposes in Writing If your organization notifies customers of purposes in writing: provide the customer with written purpose statements before or preferably at the time of collecting the customer s personal information wherever possible; provide written purpose statements to the customer at the place or venue of the collection (e.g., at your place of business, at the customer s home, or on your Web site, depending on whether the customer is supplying information in person, by mail or telephone, or electronically) wherever possible; and make written purpose statements readily available to the individual for reference in considering the question of consent. When using forms to collect personal information, explain why you are collecting the information on the forms themselves; and In any written materials used to notify customers, make sure that purpose statements are prominently displayed and easy to find, read and understand. Use plain language when possible. Identify New Purposes If some time after the original collection your organization intends to use or disclose a customer s personal information for a new purpose not previously identified: seek guidance from your Privacy Officer about possible privacy impacts; identify and document the new purpose and explain it to the customer; and obtain the customer s consent to the new purpose, unless not required by law. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 12
13 Principle 3 Consent The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Your Organization s Privacy Responsibilities Under the Consent principle, your organization must: Obtain the individual s consent for any collection, use, or disclosure of personal information, except where inappropriate (e.g., legal, medical or security reasons), as specified in Section 7 of PIPEDA. Document all exceptions and identify and support those instances when information can be collected, used, or disclosed without consent. Where it is deemed inappropriate to obtain consent, a clear documented rationale must support the exception; Ensure that the consent obtained is informed consent; Make a reasonable effort to ensure that the individual is advised of the purposes for which personal information will be used or disclosed; State and explain purposes in such a manner that the individual can reasonably understand how the personal information will be used or disclosed; Never require an individual to consent, as a condition of supplying a product or service, to the collection, use, or disclosure of information beyond what is necessary to fulfill explicitly specified and legitimate purposes; Consider the reasonable expectations of the individual in obtaining consent; Never obtain consent through deception; Take into account the sensitivity of the personal information when determining how you will obtain consent; Allow the individual to withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; and Inform the client or customer of any consequences of withdrawing consent. Under the Consent principle, your organization should: Seek consent at the time of collection for subsequent uses or disclosures of personal information; Treat all medical records and income or financial records as sensitive information; Keep in mind that any information can be sensitive, depending on the context; and Seek express consent whenever possible and always when the personal information is likely to be considered sensitive. Under the Consent principle, your organization may: Seek consent for subsequent uses or disclosures of personal information after collection but before use in certain circumstances (i.e. when you want to use personal information previously collected for a purpose not previously identified); Select an appropriate form of consent, depending on the circumstances and the type and sensitivity of personal information involved; and Rely on implied consent only when personal information is not sensitive. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 13
14 How to Meet these Objectives Fulfilling the Knowledge Requirement Understand that the validity of any consent your organization obtains will usually depend on the customer knowing your organization s purposes at the time you ask for their consent; Provide your customers with a sufficient basis of knowledge for valid consent, identify, document, and specify purposes in accordance with the Identifying Purposes principle (see preceding section); State purposes in such a manner as to enable the customer to form a reasonable understanding of the specific ways in which your organization intends to use or disclose personal information; and Take appropriate measures to ensure that your efforts to notify customers of purposes will be considered reasonable. Fulfilling the Consent Requirement Establish clear policies and procedures relating to consent, and ensure that employees who collect personal information understand the process and can implement the procedures consistently; Seek the customer s consent for the collection, use, or disclosure of personal information, unless an exception applies as specified in Section 7 of PIPEDA. Review Section 7 of PIPEDA to determine the exceptions to the consent requirement; Obtain consent for subsequent uses and disclosures at the time of collection and ensure that any deviation from this rule would meet the customer s reasonable expectations; If seeking consent after collection to a use or disclosure not previously identified, make sure that the customer is duly notified of the purpose and asked for consent before the new use or disclosure is made; Before requiring any customer to consent to a collection, use, or disclosure of personal information as a condition for receiving a product or service, make sure that the: purposes are legitimate (i.e., reasonable); customer receives explicit notification of the specific purposes; and intended collection, use, or disclosure does not exceed what is necessary to fulfill the purposes. Do not make consent for secondary purposes, such as marketing, a condition for supplying a customer with a product or service; Where a purpose is secondary or such that consent to it cannot reasonably be required of an individual as a condition for supplying a product or service, identify the purpose and the consent as optional, and notify the individual of his or her options; Consent regarding pre-pipeda information: For guidance on consent relating to use or disclosure of any personal information your organization collected before becoming subject to PIPEDA, refer to the OPC document Best Practices for Dealing with Pre-PIPEDA Personal Information (Grandfathering) available at and For guidance on consent relating to the recording of customer telephone calls, refer to the OPC document Guidelines for Recording Customer Telephone Calls available at office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 14
15 Choose the Appropriate Form of Consent Before choosing the form of consent to use in a given situation (i.e., express, implied, opt-in, opt-out), refer to the OPC fact sheet Determining the appropriate form of consent under the Personal Information Protection and Electronic Documents Act available at Consider the sensitivity of the personal information, the reasonable expectations of the customer, and the circumstances; Use express (opt-in) consent wherever feasible and in all situations involving personal medical or financial records or any other personal information likely to be considered sensitive in a given context: As a best practice, use the express (opt-in) form of consent for any intended disclosure of personal information to third parties or any other secondary purpose that customers would not reasonably expect to be involved as a matter of course in their purchase of a product or service from your organization; and If your organization uses cookies or similar technologies on its Web site, notify users of this practice and its purpose, and seek their express (opt-in) consent to it. Rely upon implied consent only in situations where the intended uses or disclosures are obvious from the context and your organization can reasonably assume a certain understanding, knowledge, or acceptance on the customer s part. Methods of Obtaining Consent When using an application form to obtain consent, make sure that the purposes for the collection are clearly stated and prominently placed on the form; When using check off boxes to seek consent for sharing personal information with other organizations: identify the other organizations by name; state the purpose clearly; ensure that the check off arrangement itself is clear and unambiguous; as a best practice, use only one box either a yes or a no ; if the personal information is sensitive or if the other organizations remain unidentified, use strict opt-in consent in the form of a single yes box and if the customer does not check the box, do not assume consent; use opt-out consent (i.e., a no box) only if the personal information is demonstrably not sensitive (this generally means information that is publicly available) if using both a yes and a no box, clarify the form of consent intended by explaining what happens in the event that the customer does not check either box, indicating whether your organization assumes consent or not; and if using both a yes and a no box and the personal information is sensitive, treat the check off mechanism as opt-in consent; if the customer does not check either box, do not assume consent. Ensure that employees responsible for obtaining consent by phone understand the process and can consistently follow your organization s procedures; and Limit the practice of assuming implied consent from a customer s use of a product or service to those situations a customer would reasonably expect to be involved in the provision of the product or service. As a general rule, do not assume a customers implied consent for secondary purposes from their use of a product or service. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 15
16 Provide for Withdrawal of Consent Since customers have the right to withdraw consent at any time (subject to legal or contractual restrictions and reasonable notice), provide a convenient way for them to do so easily, inexpensively, and with immediate effect. Toll-free telephone is the preferred option; Add information on the opportunity and mechanism for consent withdrawal to all published materials relevant to identifying purposes and seeking consent. When relying on opt-out consent to secondary purposes, ensure the consent withdrawal mechanism is brought to customers attention at the time of assuming consent; and Before or at the time any customer requests withdrawal of consent, inform the customer of the implications of such withdrawal. Withdrawal of consent to secondary purposes should not entail serious implications relating to the provision of products or services. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 16
17 Principle 4 Limiting Collection The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. Your Organization s Privacy Responsibilities Under the Limiting Collection principle, your organization must: Limit its collection of personal information (the amount and the type) to what is necessary for identified purposes; Never collect personal information indiscriminately; Collect personal information only by fair and lawful means, without misleading or deceiving the individual about the purposes for collection, and without deception in obtaining consent; and Specify types of information collected as part of the organization s information handling policies and practices, in accordance with the Openness principle. How to Meet these Objectives Review Collection Practices Verify that your organization consistently collects personal information in a fair and lawful way, not indiscriminately, and without deception about purposes and consent; Determine why you collect personal information, and what the minimum amounts and types of information necessary to fulfill those purposes; Make a clear distinction between obligatory and optional information. Some key information is necessary to provide a service, while other information may be useful, but is not necessary, such as a driver s license when goods are returned. Designate nice-to-have information as optional for the consumer; Limit your organization s collection of personal information to the minimum amounts and types necessary for the identified purposes. Information should not be collected on the basis that it might prove useful in the future; and Where possible make use of anonymized or non-personal information such as a customer number instead of a name. Document Collection Practices In order to communicate with customers in accordance with the Openness principle, document your collection policy and practices in your organization s privacy literature. Specify clearly the types of information you collect, as well as the purposes for collection; Assign specific purposes to specific information types. Also be sure to account for information your organization collects from any source other than from the customers themselves (e.g., credit report obtained by lender from credit reporting agency); and Establish procedures for collecting personal information. Make sure all staff understand and respect the limitations on collection of personal information. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 17
18 Obligatory vs. Optional Information In notifying customers, orally or in writing, why you re collecting information, distinguish clearly between that which is obligatory and that which is optional. Optional information is merely useful, as opposed to necessary, and includes any information collected solely for secondary purposes; If your organization requests any type of information that cannot reasonably be considered strictly necessary for fulfilling a certain purpose (e.g., social insurance numbers for the purpose of identification), notify customers at collection time that the information is optional; If your organization collects social insurance numbers for any purpose, make sure that such collection and any subsequent uses or disclosures are in accordance with OPC guidelines as documented in Best Practices for the Use of Social Insurance Numbers in the Private Sector (available at In general the OPC suggests limiting the use of social insurance numbers to those prescribed by law; and In notifying customers of the purposes for collection, clearly indicate types of information your organization is required to collect by law. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 18
19 Principle 5 Limiting Use, Disclosure, and Retention Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes. Your Organization s Privacy Responsibilities Under the Limiting Use, Disclosure, and Retention principle, your organization must: Never use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required by law; Document any new purpose for collecting personal information; Retain personal information only as long as necessary to fulfill the purpose; If personal information has been used to make a decision about an individual, retain the information long enough to allow the individual access to the information after the decision has been made; and Develop guidelines and procedures to govern the disposal of personal information. Under the Limiting Use, Disclosure, and Retention principle, your organization should: Destroy, erase, or anonymize any personal information that is no longer required to fulfill identified purposes 3 ; Develop guidelines and implement procedures with respect to the retention of personal information; and Include minimum and maximum retention periods in these guidelines. Note The Safeguards principle also refers to the destruction of personal information. Specifically, Principle of Schedule 1 states: Care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information. It should be noted that simple recycling of paper-based personal information is not the same as destruction. 3 Unless a request has been made to access the information in which case it should be retained as long as necessary to allow the individual to exhaust any recourse they may have including complaints to the OPC and any subsequent court proceedings. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 19
20 How to Meet these Objectives Limit Use and Disclosure Use or disclose personal information only for purposes identified and documented at the time it was collected; If your organization wishes to use or disclose personal information for any new purpose not identified at the time it was collected, document the new purpose, notify the persons concerned, and seek their consent (unless the new use or disclosure is required by law or unless an exception in Section 7 of PIPEDA applies); and Make sure that all staff handling personal information understand and respect the limitations on use and disclosure. Retention and Destruction Review your organization s information holdings to determine if all personal information on file was collected for specific purposes and whether it is still necessary to fulfill the purposes for which it was collected or to comply with legislative requirements; If you determine that some personal information on file has no specific purpose or is no longer necessary, use appropriate safeguards to destroy, erase or anonymize it; Develop guidelines and implement secure procedures to retain and destroy personal information. Set retention and destruction schedules, including minimum and maximum retention periods, taking into account any legislative requirements which apply to your organization; Where personal information is used to make a decision about an individual, set a retention period that will give the individual a reasonable amount of time to access the information after the decision is made; Base your organization s retention policy and practices on the premise that information should be retained only as long as necessary for the fulfillment of the purposes for which it was collected; Conduct periodic audits or spot-checks of your holdings to ensure personal information is not being retained beyond established time frames; To prevent improper disclosure, establish secure methods for destroying information no longer needed (e.g., shredding paper files or securely deleting electronic records). Consider, for example, the risks associated with the disposal of computers where personal information has been left on the hard drive; Develop policies and/or contracts which apply to third parties engaged in the disposal of personal information on behalf of your organization; and For guidance on retention of personal information your organization collected before it became subject to PIPEDA, refer to the OPC document, Best Practices for Dealing with Pre-PIPEDA Personal Information available at office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 20
21 Principle 6 Accuracy Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. Your Organization s Privacy Responsibilities Under the Accuracy principle, your organization must: Ensure that personal information is as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used; Routinely update personal information only if such a process is necessary to fulfill the purposes for which the information was collected; Ensure that information is sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual; and In determining the extent to which personal information must be accurate, complete, and up-to-date, take into account the use of the information and the interests of the individual. Under the Accuracy principle, your organization should: Keep any personal information that is used on an ongoing basis accurate and up-to-date, including information that is disclosed to third parties, where limits are not set out around the requirement for accuracy. How to Meet these Objectives Determine accuracy needs Review why your organization collects personal information, balancing how the information will be used and the interests of the customer; Personal information should be routinely updated only in circumstances where updating is necessary to fulfill the purposes for which the information was collected; Accuracy, completeness, and currency are essential in circumstances where the use of inaccurate, incomplete, or outdated information could negatively influence a decision to be made about a customer or otherwise harm the customer 4 ; Assess the importance of accuracy, completeness, and currency in circumstances where information is used on an ongoing basis or is routinely disclosed to third parties; and Consider if you can reasonably expect customers to adopt responsibility themselves to correct or to provide up-to-date information, such as change-of-address notification for subscriptions. 4 For example, outdated financial information could cause a bank to deny a customer a loan or service. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 21
22 Establish an Accuracy Policy Ensure that your privacy management framework includes procedures detailing: the types of personal information that need to be routinely updated for accuracy and completeness; where warranted, schedules and procedures for routinely verifying the accuracy of personal information and keeping it accurate and up-to-date; a requirement to record when personal information is received or updated and the steps taken to verify accuracy, completeness, and currency of the information; how customers can challenge the accuracy and completeness of personal information and how to amend their information as appropriate, in accordance with the Individual Access principle; clear limits to the requirement for accuracy, and an explanation for any personal information that your organization: uses or discloses on an ongoing basis but does not intend to keep accurate and up-to-date; can reasonably expect customers to correct or update on their own initiative. Make information on your organization s accuracy procedures readily available to the public, in accordance with the Openness principle. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 22
23 Principle 7 Safeguards Personal information shall be protected by security safeguards appropriate to the sensitivity of the information. Your Organization s Privacy Responsibilities Under the Safeguards principle, your organization must: Protect personal information by security safeguards appropriate to the sensitivity of the information; Institute security safeguards that will protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification; Protect personal information regardless of the format in which it is held; Make employees aware of the importance of maintaining the confidentiality of personal information; and Use care to prevent unauthorized access when destroying or disposing of personal information. Under the Safeguards principle, your organization should: Safeguard more sensitive information with a higher level of protection; Include among its methods of protection: physical measures such as locked filing cabinets and restricted access to offices; organizational measures such as security clearances and limiting access on a need to know basis; and technological measures such as use of passwords and encryption. Under the Safeguards principle, your organization may: Use a variety of safeguards, depending on the information s sensitivity, amount, distribution, format, and method of storage. How to Meet these Objectives Establishing an Informational Security Policy Review your present information security practices, policies, and systems to determine whether your organization is currently meeting its responsibilities outlined above. Take appropriate measures as recommended below to address any deficiencies; and Develop and implement a policy, or update your existing procedures, consolidating your information security practices and procedures in accordance with the Safeguards principle. Include a requirement and procedures for documenting and following up on security breaches and informing the individuals affected. Ensure that your policy addresses the following responsibilities as applicable. office of the privacy commissioner of canada PIPEDA Self-Assessment Tool 23