91¹û¶³´«Ã½

Personal Information Privacy Policy

91¹û¶³´«Ã½ is governed by privacy legislation enacted by the Province of Alberta and the Government of Canada. The Personal Information Privacy Act (PIPA) protects the personal information of the public and employees of organizations operating in Alberta. It governs the collection, use, disclosure and retention of personal information by organizations in a manner that recognizes and balances the right of an individual to have his or her personal information protected, and the need of an organization to collect, use, disclose or retain personal information for purposes that are reasonable. 91¹û¶³´«Ã½ is bound by the requirements of PIPA as well as other provincial and federal legislation, and 91¹û¶³´«Ã½ collects, uses, discloses and retains personal information in accordance with this legislation. In keeping with provincial and federal legislation, 91¹û¶³´«Ã½ has enacted its Personal Information Privacy Policy (PIPP).

I. The Purpose of PIPP

The purpose of PIPP is to govern the collection, use, disclosure and retention of personal information by 91¹û¶³´«Ã½ in a manner that recognizes: 1) the right of an individual to have his or her personal information protected; and 2) the need of 91¹û¶³´«Ã½ to collect, use, disclose and retain personal information for purposes that are reasonable.

91¹û¶³´«Ã½ will also develop reasonable practices and procedures to implement PIPP so that it can meet its obligations under provincial and federal legislation.

II. The Scope of PIPP

PIPP shall apply to the following persons and in the following circumstances:

1. 91¹û¶³´«Ã½ employees, students, volunteers (including board members), contractors and agents providing services on behalf of 91¹û¶³´«Ã½;
2. 91¹û¶³´«Ã½ alumni, donors, and friends;
3. Individuals who request information about 91¹û¶³´«Ã½ as well as those who apply to work, teach, or study at 91¹û¶³´«Ã½;
4. Any personal information that identifies an individual, in whatever form or medium (paper, digital, audio-visual, graphic, website, etc.) created or received in the course of carrying out 91¹û¶³´«Ã½’s mandated functions and activities; and,
5. All facilities and equipment required to collect, manipulate, transport, transmit, or keep information at 91¹û¶³´«Ã½. PIPP and PIPA do not apply to personal information that is in the custody of 91¹û¶³´«Ã½ if the Freedom of Information and Protection of Privacy Act applies to that information.

III. The Privacy Principles of PIPP

91¹û¶³´«Ã½ is committed to protecting the privacy of employees, students, volunteers, alumni, donors, and friends. To that end, 91¹û¶³´«Ã½ has implemented the following provisions to ensure that personal information is protected:

1.0 Accountability

1.1 91¹û¶³´«Ã½ is responsible for protecting the confidentiality of personal information in its custody or under its control in compliance with the applicable federal or provincial legislation.

1.2 91¹û¶³´«Ã½ has identified and designated a Privacy Officer to be responsible for implementing the privacy program and ensuring compliance with legislation.

1.3 Where 91¹û¶³´«Ã½ engages the services of a person or corporation, whether as an agent, by contract or otherwise, 91¹û¶³´«Ã½ is responsible for that person’s or corporation’s compliance with PIPP.

1.4 Where 91¹û¶³´«Ã½ discloses or transfers personal information to a third party, 91¹û¶³´«Ã½ is responsible for that third party’s compliance with PIPP.

2.0 Identifying Purposes

2.1 91¹û¶³´«Ã½ collects information that it requires to carry out its functions as a post-secondary institution pursuant to legislation and regulations. The information that is collected is necessary for 91¹û¶³´«Ã½ to fulfill its mandate, duties and obligations as a post-secondary institution.

2.2 91¹û¶³´«Ã½ will identify the purposes for which personal information is collected. The purposes for which personal information is collected shall be identified either in writing or verbally before or at the time the information is collected. 91¹û¶³´«Ã½ may also provide the name of a 91¹û¶³´«Ã½ representative who may provide additional information concerning the purpose for the collection, use, disclosure and retention of the personal information.

3.0 Consent

3.1 91¹û¶³´«Ã½ collects personal information only for reasonable purposes and with the consent of the individual, except where otherwise authorized by legislation. More specifically, 91¹û¶³´«Ã½ will not: a. collect personal information about an individual unless that individual consents to the collection of that information; b. collect personal information about an individual from a source other than the individual, unless that individual consents to the collection of that information from the other source; c. use personal information about an individual unless that individual consents to the use of that information; or d. disclose personal information about an individual unless that individual consents to the disclosure of that information.

3.2 91¹û¶³´«Ã½ shall not require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary for 91¹û¶³´«Ã½ to carry out its mandate, duties and obligations.

3.3 An individual may give his or her consent in writing or orally to the collection, use disclosure and retention of personal information about the individual. An individual is deemed to consent to the collection, use, disclosure or retention of personal information for a particular purpose if: a. b.

3.4 the individual, after being advised of the purpose for collecting and using the information, provides the information for that purpose; and it is reasonable that a person would voluntarily provide that information. When 91¹û¶³´«Ã½ collects, uses, discloses or retains personal information about an individual for a particular purpose, it will provide the individual with a notice in a form that the individual can reasonably be expected to understand. a. b.

3.5 The said notice will indicate that 91¹û¶³´«Ã½ intends to collect, use or disclose personal information about the individual for a particular purpose. The said notice will give the individual a reasonable opportunity to decline or object to having his or her personal information collected, used or disclosed for those purposes. An individual may convey his or her consent to 91¹û¶³´«Ã½ in writing. If it not feasible to obtain written consent, then an individual may convey his or her consent verbally or by electronic means.

3.6 An individual may at any time withdraw or vary his or her consent to the collection, use, disclosure or retention of personal information. Upon receiving notice that an individual intends to withdraw or vary his or her consent, 91¹û¶³´«Ã½ will endeavour to inform the individual of the likely consequences of withdrawing or varying the consent.

3.7 If an individual withdraws or varies his or her consent to the collection, use, disclosure or retention of personal information, 91¹û¶³´«Ã½ will a. stop collecting, using, disclosing or retaining the information upon receipt of the withdrawal of consent; or b. abide by the directions of individual in the case of a variation of consent. 91¹û¶³´«Ã½ will not abide by the individual’s decision to withdraw or vary his or her consent if this decision would frustrate 91¹û¶³´«Ã½â€™s performance of a legal obligation as required or permitted by law.

3.8 91¹û¶³´«Ã½ may collect, use, disclose or retain personal information about an individual without the consent of that individual when it is permitted pursuant to PIPA, or when it is prescribed or permitted by a statute or regulation of the Province of Alberta or the Government of Canada.

3.9 Any information about an individual that was collected by 91¹û¶³´«Ã½ prior to January 1, 2004, is deemed to have been collected with the consent of the individual.

3.10 91¹û¶³´«Ã½ may collect, use, disclose or retain personal information about an individual without the consent of that individual as provided in sections 14, 17, and 20 of PIPA.

4.0 Limiting Collection

4.1 91¹û¶³´«Ã½â€™s collection of personal information shall be limited to that which is reasonably necessary for the identified purpose. 91¹û¶³´«Ã½ shall only collect personal information in a fair and lawful manner.

5.0 Limiting Use, Disclosure and Retention

5.1 91¹û¶³´«Ã½ will not use, disclose or retain personal information for purposes other than those for which the information was collected, except with the consent of the individual, or as permitted or required by law.

5.2 When an individual has given consent to 91¹û¶³´«Ã½ to: a) b) collect personal information from a third party, or disclose personal information to a third party, then before or at the time that the personal information is collected or disclosed, 91¹û¶³´«Ã½ will notify the third party that the individual has consented to the collection or disclosure of the personal information.

5.3 Notwithstanding that an individual has withdrawn or varied his or her consent, 91¹û¶³´«Ã½ may for legal purposes retain personal information as long as is reasonable.

6.0 Accuracy

6.1 91¹û¶³´«Ã½ will make all reasonable efforts to ensure that personal information collected, used, disclosed or retained by or on behalf of 91¹û¶³´«Ã½ is accurate, complete and current.

7.0 Safeguards

7.1 91¹û¶³´«Ã½ will protect personal information by taking such measures as:
a. Implementing technological safeguards to secure personal information that is stored in electronic form;
b. Ensuring that the areas in which information is stored are reasonably secure;
c. Restricting access to personal information stored in paper form; and
d. Preventing unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction of the personal information.

8.0 Openness

8.1 91¹û¶³´«Ã½ develops and follows privacy and security policies that are compliant with legislation. 91¹û¶³´«Ã½ will make information about PIPP, and related polices and practices available on request.

9.0 Individual Access

9.1 An individual has the right to access his or her personal information held by 91¹û¶³´«Ã½, subject only to limited and specific exceptions. Individuals can address any request for access to information to 91¹û¶³´«Ã½â€™s Privacy Officer. All requests for access to personal information must be in writing.

9.2 91¹û¶³´«Ã½ will not provide an individual with access to his or her personal information if:
a. the disclosure of the information could reasonably be expected to threaten the life or security of a third party;
b. the information would reveal personal information about a third party;
c. the information would reveal the identity of a third party who has in confidence provided an opinion about the individual, and the third party does not consent to disclosure of his or her identity, or to release of the third party’s information; or
d. 91¹û¶³´«Ã½ is permitted by law to refuse access.

9.3 If 91¹û¶³´«Ã½ is reasonably able to sever the information referred to in section 9.2 from a copy of the record that contains personal information about the individual who requested it, then 91¹û¶³´«Ã½ will provide the individual with access to the record after the information referred to in section 9.2 has been severed.

9.4 Any right or power conferred on an individual by these policies may be exercised by a third party as provided in section 61 of PIPA.

10.0 Challenging Compliance

10.1 An individual may also challenge the accuracy and completeness of the information held by 91¹û¶³´«Ã½ and have it amended as appropriate.

10.2 If an individual requests a correction of an error or omission in the personal information, 91¹û¶³´«Ã½ will, subject to legal limitations, correct the information as soon as is reasonably possible or annotate it with the correction that was requested. Where 91¹û¶³´«Ã½ has disclosed incorrect information to a third party, 91¹û¶³´«Ã½ will send a notification containing the corrected information to each third party to which the incorrect information has been disclosed, if it is reasonable to do so.

10.3 91¹û¶³´«Ã½ will not correct or otherwise alter an opinion, including a professional or expert opinion, that is contained in personal information.

10.4 91¹û¶³´«Ã½’s Privacy Officer will make every reasonable effort to assist individuals asking for access to or correction of their personal information, and will respond as accurately and completely as is reasonably possible within the time limits specified in PIPA.

10.5 All requests must be in writing and must set out in sufficient detail the scope of the request. Requests should be delivered or mailed to 91¹û¶³´«Ã½’s Privacy Officer. If a request is complex and requires an extensive or detailed search, 91¹û¶³´«Ã½ may, at its sole discretion, charge a reasonable fee. 91¹û¶³´«Ã½ will give the applicant a written estimate of the total fee before providing the service, and may require the applicant to pay a deposit in the amount determined.

10.6 Individuals can address any complaint regarding compliance with the above principles with 91¹û¶³´«Ã½’s Privacy Officer. An individual who makes a request respecting personal information may ask the Alberta Privacy Commissioner to review any 91¹û¶³´«Ã½ decision, action, or refusal to act.

11.0 Other Provisions

11.1 Concordia will not take any adverse employment action against an employee, or deny an employee a benefit, on account of or for any reason arising out of the situation where a 91¹û¶³´«Ã½ employee, acting in good faith and on the basis of reasonable belief:
a. has disclosed to the Alberta Privacy Commissioner that 91¹û¶³´«Ã½ or any other person has contravened or is about to contravene privacy legislation;
b. has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene privacy legislation;
c. has refused to do or stated an intention of refusing to do anything that is in contravention of privacy legislation.

11.2 91¹û¶³´«Ã½ provides information on its website concerning 91¹û¶³´«Ã½’s programs, activities, faculty, and staff. 91¹û¶³´«Ã½ has developed a specific privacy policy for its website, and this website privacy policy will always be posted on 91¹û¶³´«Ã½’s website.