Personal Information Protection Policy

Purpose

This Policy governs the collection, use and disclosure of Personal Information by the Town of Erin from and about Committee Members, Program Participants, and Employees of the Town of Erin or from other individuals who may access the Town's website.

This Policy has been developed in accordance with the principles set out in the Personal Information Protection and Electronic Documents Act, Statutes of Canada 2000, Chapter 5 (PIPEDA).

Policy

1. Definition of Personal Information

For the purposes of this policy, Personal Information is defined as "any information about an identified individual, recorded in any form, that can be used to distinguish, identify, evaluate or contact the individual or which can be used to infer or determine the identity of an individual".

Personal Information collected by the Town includes:

1. Home address, home telephone number and person e-mail address information;
2. Business e-mail address information;
3. Employee information required for payroll and employee benefit purposes including date of birth, marital status, social insurance number, banking information and beneficiary and dependent information;
4. Information gathered from current or prospective employees for recruitment and retention purposes including resumes, application letters, employment references, disciplinary records and performance evaluations;
   For greater certainty, as set out in Regulations accompanying the PIPEDA Legislation, Personal Information does not include an individual's name, job title, employer name, and business address or business telephone number.

2. Collecting and Retaining Personal Information - Committee Membership

The Town collects and retains Personal Information from new and existing Committee Members in order to establish a point of contact for future mailings and distribution of communications.

The Town may disclose the Personal Information collected from Committee Members to organizations that assist the Town with communication distribution. Personal Information will only be provided to such organizations if they agree to use such information solely for the purpose of distributing Town communications under the instruction of the Town and, with respect to that information, to act in a manner consistent with the principles articulated in this Policy.

Members' consent to the collection and retention of this Personal Information is presumed to be given at the time of submitting the information to the Town.

Forms utilized to gather this Personal Information will clearly indicate the purposes for which the information is being collected and retained.

Personal Information, excluding financial information, collected from Members is retained;

1. For the duration of the individual's membership on the Committee
2. Until such Personal Information is superceded, in which case any "obsolete" Personal Information is destroyed;
3. For a period of one (1) year following an individual's termination of their committee appointment.

Financial information collected from members is retained.

3. Collecting and Retaining Personal Information - Employees and Prospective Employees

The Town collects and retains Personal Information from Employees in order to:

1. Administer payroll and benefit plans;
2. Process Employee work-related claims, such as WSIB claims, insurance claims and disability claims;
3. Establish training and/or development requirements;
4. Assess qualifications for a particular assignment, job or task;
5. Gather evidence, as applicable and necessary, for pay for performance programs or disciplinary action;
6. Establish a contact point in case of emergency;
7. Comply with applicable labour or employment statutes.

The Town may disclose the Personal Information collected from Employees to organizations that assist the Town with the administration of the Town's employee benefit plans or have been retained for labour relations purposes. Personal Information will only be provided to such organizations if they agree to use the information solely for the purpose of providing services to the Town and under the instruction of the Town and, with respect to the information, to act in a manner consistent with the principles articulated in this policy.

Employee consent to the collection and retention of this Personal Information shall be made in writing at the time of submitting the information to the Town.

Forms utilized to gather this Personal Information will clearly indicate the purposes for which the information is being collected and retained.

Person Information, excluding financial information, collected from Employees is retained;

1. For the duration of the individual's employment with the Town
2. Until such Personal Information is superceded, in which case any "obsolete" Personal Information is destroyed;
3. For a period as set out in the Town's retention by-law.

Financial information collected from Employees is retained;

1. As required to comply with audit, statutory or other legal purposes.

The Town also collects and retains Personal Information from Prospective Employees through a recruitment process in order to:

1. Determine eligibility for initial employment, including the verification of references and qualifications;
2. Assess qualifications for a particular assignment, job or task.

A Prospective Employee's consent to the collection and retention of this Personal Information is presumed to be given at the time of submitting the information to the Town. Published and verbal requests for this Personal Information will clearly indicate the purposes for which the information is being collected and retained.

Personal Information collected from Prospective Employees, not selected through a recruitment process, is retained;

1. For the duration of the recruitment process up to and including the date upon which the selected applicant accepts an offer of employment.

Unsolicited Personal Information received from Prospective Employees is not retained by the Town and is discarded upon receipt.

4. Collecting and Retaining Personal Information - Town Web Site

The Town does not collect any Personal Information from individuals accessing the public portions of the Town's Web site. The Town's Web site operating system may automatically record certain general, and non-personal, information regarding an individual' access to the Town's Web site. Further information regarding the non-personal information collected is contained in the Town's Web Site Privacy Policy document.

The Town's Web site does provide links to other Web sites. Once an individual links to another site, the individual is subject to the privacy and security policies of the new site. The Town does not retain any responsibility with respect to the collection and retention of Personal Information by other organizations through these linked Web site.

5. Monitoring of Computer Resources, Premises and E-mail Activity

The Town provides its Employees with computers, telephones and related office and communications equipment, as well as software applications.

The Town may monitor its computer resources to ensure that damage to these resources is limited and that illegal use is prohibited. The Town may also monitor its physical premises to ensure that only authorized personnel access the Town's offices or certain areas within these offices. Such monitoring is undertaken to ensure the efficient use of the Town's systems and equipment, to protect the Town's property and to ensure compliance with applicable laws and Town policies.

In the course of conducting business, the Town may monitor Employee e-mail activities. E-mail applications will normally contain all e-mails that have been sent and received by Town Employees. Back-ups and archives may also contain copies of e-mails that Employees have deleted. The e-mail system utilized by the Town is the property of the Town but Employees may send and receive personal e-mail on the understanding that such e-mails are neither private nor confidential. The Town reserves the right to monitor the e-mail system, including all e-mail sent, received or created. Access rights to Employee e-mail boxes and logs will be restricted to those individuals with the responsibility for administering the Town's information technology systems. Such access will be as limited as possible.

All monitoring will be done on an "as required" basis and will be in proportion to the risks that the Town faces. The Town will conduct any monitoring in the least intrusive way possible.

6. Exchange of Personal Information with Other Organizations

Unless detailed in this Policy, the Town does not sell, trade, barter or exchange for consideration any Personal Information collected.

7. Disclosure of Personal Information - Special Circumstances

Circumstances may arise where the use and/or disclosure of Personal Information may be justified or permitted or where the Town is obliged to disclose the information without consent. Such circumstances would include, but not be limited to:

1. Where required by law or by order of a court, administrative agency or other governmental tribunal;
2. Where the Town believes, upon reasonable grounds, that disclosure is necessary to protect the rights, privacy, safety or property of an identifiable person or group;
3. Where required to determine or administer Employee pay or benefits;
4. Where it is alleged that the person concerned is: guilty of a criminal offence, civilly liable in a legal action; or guilty of professional misconduct;
5. Where disclosure is necessary to permit the Town to pursue available remedies or limit any damages that it may sustain;
6. Where the information is otherwise deemed to be public information.

Where obliged or permitted to disclose Personal Information without consent, the Town will not disclose more information than is required.

8. Maintaining Accuracy of Personal Information

To the best of its ability, the Town will ensure that any Personal Information in its possession is as accurate, current and complete as necessary for the purposes for which the Town has collected the information.

9. Security of Information

The Town will maintain adequate physical, procedural and technical security with respect to its offices and information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of Personal Information collected and retained.

As part of these precautions, the Town will restrict access to an individual's Personal Information to those employees or organizations that the Town determines require access to the information in order to fulfill their respective responsibilities to the Town.

If an employee or organization misuses the Personal Information to which they have access, this will be considered a serious offence. In the case of an employee, disciplinary action will be taken which, depending upon the degree of misuse, may include termination of employment. If an organization providing services to the Town misuses the Personal Information, action will be taken, up to and including termination of the service agreement between the Town and the organization.

10. Accessing and Updating Personal Information

Upon request, the Town will provide Committee Members, Program Participants and Employees access to the Personal Information Collected and retained about them. If the Member, Program Participant or Employee believes that the Personal Information about them is not correct, they may, depending upon the nature of the Personal Information, make or request an amendment to the information. The Town reserves the right to not change the Personal Information but will append any alternative information, which the individual concerned believes to be appropriate.

Requests for access to Personal Information will be addressed within a reasonable time and no later than thirty (30) days following the date of the request.

To guard against fraudulent requests for access or corrections, the Town may request sufficient information to allow the Town to confirm that the individual making the request is authorized to do so, before granting access or making corrections.

The Town reserves the right to decline to provide access to Personal Information, upon the request of an individual, where the information requested;

1. Would disclose Personal Information, including opinions, about another individual or about a deceased individual;
2. Would disclose confidential information about the Town or a third party that may harm the Town or third party or interfere with contractual or other negotiations of the Town or a third party;
3. Is subject to solicitor-client or litigation privilege;
4. Is not reasonably retrievable and the burden or cost of providing the information would be disproportionate to the nature or value of the information;
5. Does not exist, is not held, or cannot be found by the Town;
6. Could reasonably result in serious harm to the treatment or recovery of an individual concerned, serious emotional harm to the individual or another individual, or serious bodily harm to another individual;
7. May harm, or interfere with law enforcement activities and other investigative or regulatory functions of a body authorized by statute to perform such functions.

Where information will not or cannot be disclosed, the individual making the request will be provided with the reasons for non-disclosure.

The Town reserves the right to not respond to repetitious or vexatious requests for access.

11. Questions Regarding the Town's Privacy Policy

In the event that a Member, Program Participant or Employee of the Town has questions about;

1. Access to personal Information collected and retained by the Town;
2. The collection, use, management or disclosure of Personal Information;
3. The contents of the Town's Privacy Policy;

the individual will be directed to contact the Clerk.

12. Revisions to Policy

The Town may, from time to time, review and revise its privacy practices and this Policy. In the event of a policy amendment, the Town's Committee Members, Program Participants, and Employees and other individuals who may access the Town's Web site will receive appropriate notice as soon as possible following the amendment. Policy changes will apply to Personal Information collected from the date of the revised Policy as well as existing Personal Information, which the Town has already collected and retained.