|
This
type of information is protected under the "Personal
information Protection and Electronic Documents Act".
The following ACT will review personal data information and
your responsibility to safeguard it.
What
is the Personal Information Protection and Electronic
Documents Act?
Part 1
of the Personal Information Protection and Electronic
Documents Act sets down the ground rules for how
organizations may collect, use or disclose information about
you in the course of commercial activities. The law gives
you the right to see and ask for corrections to information
an organization may have collected about you. If you think
an organization covered by the Act is not living up to its
responsibilities under the law, you have the right to lodge
an official complaint.
What
is personal information?
"Personal
information" under the Act means information about an
"identifiable individual".
For
example, "personal information" includes your
- Name,
age, weight, height
- Medical
records
- Income,
purchases and spending habits
- Race,
ethnic origin and color
- Blood
type, DNA code, fingerprints
- Marital
status and religion
- Education
- Home
address and phone number
"Personal
information" does not include the name, job
title, business address or office telephone number of an
employee of an organization that is covered by the new law.
How
does the Act protect my personal information?
·
Your
ability to control your personal information is key to your
right to privacy.
·
The
Act gives you control over your personal information by
requiring organizations to obtain your consent to collect,
use or disclose information about you. The Act confers
certain rights on individuals, and imposes specific
obligations on organizations.
The
law gives you the right to:
- Know
why an organization collects, uses or discloses your
personal information;*
- Expect
an organization to collect, use or disclose your
personal information reasonably and appropriately, and
not use the information for any purpose other than that
to which you have consented;*
- Know
who in the organization is responsible for protecting
your personal information;
- Expect
an organization to protect your personal information by
taking appropriate security measures;
- Expect
the personal information an organization holds about you
to be accurate, complete and up-to-date;
- Obtain
access to your personal information and ask for
corrections;*
- Complain
about how an organization handles your personal
information.
The
law requires organizations to:
- Obtain
your consent when they collect, use or disclose your
personal information;*
- Supply
you with a product or a service even if you refuse
consent for the collection, use or disclosure of your
personal information unless the information is essential
to the transaction;*
- Collect
information by fair and lawful means;
- Have
personal information policies that are clear,
understandable and readily available.
An
organization should destroy, erase or make anonymous
personal information about you that it no longer needs in
order to fulfill the purpose for which it was collected.
*There
are exceptions to these principles. For example: an
organization may not need to obtain your consent if
collecting the information clearly benefits you and your
consent cannot be obtained in a timely way; or if the
information is needed by a law enforcement agency for an
investigation, and getting consent might compromise the
information's accuracy.
How
can I see the personal information an organization has about
me?
- Send
a written request to the organization holding your
personal information. You must provide enough detail to
allow the organization to identify the information you
want; for example, include dates, account numbers, and
the names or positions of people you may have dealt with
at the organization.
- Organizations
must provide the information requested within a
reasonable time and at minimal or no cost.
How
can I correct errors or omissions in my personal
information?
- Write
to the organization that has personal information about
you and explain the correction you are requesting and
why. Supply copies of any documents that support your
request, if you have them.
- If
the organization refuses to correct your personal
information, you may require it to attach a statement of
your disagreement to the file. This statement must be
passed on to any other organization that may have access
to the information.
What
if I believe my privacy rights are being abused?
The Act
gives you the right to make a complaint if:
- You
run into any difficulties obtaining your personal
information, if an organization refuses to correct
information you consider inaccurate or incomplete, or if
you suspect your personal information has been
improperly collected, used or disclosed;
- You
believe an organization is not following any provision
of the law.
Where
do I complain?
- Contact
the Office of the Privacy Commissioner of Canada during
business hours by calling 1 800 282-1376 if you need
more information and advice on how you should proceed.
- We
encourage you to try to settle the matter directly with
the organization about which you are complaining by
contacting the person responsible for handling privacy
issues
- Within
the organization.
- If
you are not satisfied with the organization's response,
you may contact the organization's industry association,
ombudsman or complaint office, if there is one. For
example, the Canadian Marketing Association and the
Canadian Banking Ombudsman handle customers' complaints
about their member companies.
- If
you are not satisfied with the way the organization or
industry association handles the matter, contact the
Privacy Commissioner of Canada. There is no fee for
making a complaint to Privacy Commissioner.
What
is the role of the Privacy Commissioner of Canada?
- The
Privacy Commissioner is an ombudsman who attempts to
resolve disputes through negotiation.
- The
Commissioner has the power to investigate your
complaint.
- The
Commissioner may also initiate his own investigation or
review how an organization handles personal information.
- The
Commissioner can recommend that the organization release
your personal information to you or correct
inaccuracies.
- The
Commissioner can recommend that organizations change
their personal information practices.
- The
Commissioner will report the findings of the
investigation to you and the organization.
What
if the organization ignores the recommendations of the
Privacy Commissioner?
- The
Privacy Commissioner has the power to make public any
information about the personal information practices of
an organization. Few businesses would like to be
publicly identified as violating the privacy rights of
individuals.
- The
Privacy Commissioner may also take the complaint to the
Federal Court of Canada on your behalf if he supports
you but has been unable to resolve the dispute.
- Once
you have received the Privacy Commissioner's report, you
may, under certain circumstances, take your complaint to
the Federal Court of Canada yourself.
- The
Court can order an organization to correct any practices
that do not comply with the law, and to publish notices
of how it has or will correct its practices.
- The
Court can also award damages to the complainant
including damages for humiliation suffered.
What
do the Personal Information Protection and Electronic
Documents Act Not Cover?
- Any
federal government organization already covered by the Privacy
Act.
- Provincial
or territorial governments, and their agents.
- Any
organization that collects uses or discloses personal
information solely for journalistic, artistic or
literary purposes.
- An
individual's collection, use or disclosure of personal
information for personal purposes, such as genealogical
research shared with other family members.
When
does the Act come into force?
The
Act takes effect in three stages spread over three years.
January
1, 2001
At this stage, the Act applies to personal information about
customers or employees (except "personal health
information") that is collected, used or disclosed by
"federal works, undertakings or businesses" in the
course of commercial activities.
(Federal
works, undertakings and businesses include organizations
such as the banks, telephone companies, cable television and
broadcasting companies, firms engaged in interprovincial
transportation, and air carriers.)
The Act
also applies to personal information that is shared or
disclosed for profit or any kind of benefit across the
borders of Canada or a province, where the information
itself is the subject of the transaction.
The Act
also covers all businesses and organizations engaged in
commercial activity in Yukon, the Northwest Territories and
Nunavut.
January
1, 2002
The Act will cover any "personal health
information" collected by those organizations mentioned
in the first stage. Personal health information is
information about an individual's mental or physical health,
including details about any tests, examinations and health
services provided.
January
1, 2004
The Act will cover the collection, use or disclosure of
personal information in the course of any commercial
activity within a province, including provincially regulated
enterprises such as retail stores. The federal government
may exempt organizations and/or activities in provinces that
have their own privacy laws that are substantially similar
to the federal law.
The Act
will apply to all personal information in all
interprovincial and international transactions by all
organizations in the course of their commercial activities.
FOR
MORE INFORMATION
If you
have any questions about how a private sector organization
handles your personal information or wish to make a
complaint under the new law, please contact our office.
The
Office of the Privacy Commissioner of Canada
112 Kent Street
Ottawa, Ontario K1A 1H3
Telephone:
1 (613) 995-8210
Toll-free: 1 800 282-1376
Fax: 1 (613) 947-6850
Web site: www.privcom.gc.ca
E-mail: info@privcom.gc.ca
Please
note that this brochure summarizes the law. As such, it has
no legal status. To obtain the full text of the law, contact
the Office of the Privacy Commissioner of Canada.
Cette
publication est disponible également en français. |