Purpose
The Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use, and disclosure of personal information in a manner that recognizes the right to privacy of individual’s personal information and the need of organizations to collect, use, or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. Chicopee is committed to protecting and respecting the personal information of its customers, employees, business partners, and all other entities it interacts with in accordance with PIPEDA. This policy will provide guidelines to ensure that Chicopee remains compliant with PIPEDA requirements.
Definitions
Breach of security safeguards: The loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards, or from a failure to establish those safeguards.
Personal information: Information about an identifiable individual.
Security safeguards: Security safeguards include the following:
- Physical measures: for example, locking filing cabinets and restricting access to offices;
- Organizational measures: for example, security clearances and limiting access on a “need-to-know” basis; and
- Technological measures: for example, the use of passwords and encryption.
Significant harm: Includes bodily harm; humiliation; damage to reputation or relationships; loss of employment, business, or professional opportunities; financial loss; identity theft; negative effects on a credit record; and damage to or loss of property.
All definitions sourced from PIPEDA.
Guidelines
Compliance
Chicopee has implemented these guidelines to ensure continuing compliance with PIPEDA requirements. The personal information of Chicopee employees, customers, clients, business partners, and so on will be managed to meet the following PIPEDA requirements:
- All personal information in Chicopee possession or custody must be protected appropriately.
- Individuals must be informed as to why personal information is being collected.
- Consent must be obtained for the collection and use of information.
- The consent of an individual is only valid if it is reasonable to expect that the individual understands the nature, purpose, and consequences of the collection, use, or disclosure of the personal information.
- Personal information may only be collected without consent if:
o The collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;
o The personal information was produced by the individual in the course of their employment, business, or profession, and the collection is consistent with the purposes for which the information was provided;
o The collection is made for the purpose of making a disclosure; or
o Any other reason as defined in PIPEDA section 7(1). - Individuals have the right to withdraw their consent.
- Personal information collected is only collected, used, or disclosed for purposes that a reasonable person would consider appropriate in the circumstances.
- Personal information is used only for the purposes for which it was collected, except with the consent of the individual or as required by law.
- Personal information is retained only for the period of time that it is reasonably required.
- Personal information is destroyed that is no longer required using a safe, secure, and effective manner (for example, shredding).
- All personal information collected is accurate. Individuals are encouraged to ensure information is up-to-date but providing timely notifications of any changes.
- Individuals are allowed access to their personal information, and to make corrections as appropriate.
- Appropriate security and safeguards are employed for the protection of personal information.
- Access to personal information is limited to authorized personnel who have a legitimate need to access the information.
- Consent must generally be obtained before the release of personal information to any third party. Consent will consist of a signed document directing to whom the information will be provided, as well as the scope and nature of information to be provided.
- Consent to disclose personal information to a third party is not required if:
o Chicopee has reasonable grounds to believe that the information could be useful in the investigation of a contravention of the laws of Canada, a province or territory, or a foreign jurisdiction, and the information is used for the purpose of investigating that contravention;
o It is used for the purpose of acting in respect to an emergency that threatens the life, health, or security of an individual;
o The information was produced by the individual in the course of their employment, business, or profession, and the use is consistent with the purposes for which the information was produced; or
o Any other circumstances as defined in PIPEDA section 7(2) are met. - The forms of information being collected must be identified and communicated to the individual, as well as the rationale for the collection of these forms of information.
- Individuals must be notified and consent must be obtained before using personal information for any reason other than those provided at the time of collection.
Breaches of Security Safeguards
Reporting Breaches
If Chicopee becomes aware of a breach of our security safeguards that compromises the privacy of the personal information retained by the company, the following action shall be taken:
- CEO is responsible for coordinating the response to the breach and ensuring that all reasonable action is taken to address the breach.
- Director, Finance will notify the privacy commissioner of Canada of the breach in the prescribed form and manner as soon as feasible once Chicopee has determined that a breach has occurred. Chicopee will also submit any new information that the company becomes aware of after having made the report.
- Director, Finance will notify any affected individuals of the breach in the prescribed form and manner as soon as feasible
- Chicopee will comply to the greatest extent possible and in a timely manner with any requests, orders, or other instructions from the Office of the Privacy Commissioner of Canada in order to respond to and address the security breach.
- Chicopee will maintain records of every breach of security safeguards, and will provide the privacy commissioner of Canada with access to or a copy of a record of a breach at the request of the commissioner.
As per the Breach of Security Safeguards Regulations, the report submitted to the privacy commissioner will contain:
- A description of the circumstances of the breach and if known the cause;
- The date on which or the period during which the breach occurred or if neither is known the approximate period;
- A description of the personal information that is the subject of the breach to the extent that the information is known;
- The number of individuals affected by the breach or if unknown the approximate number;
- A description of the steps that the organization has taken to reduce the risk of harm to affected individuals that could result from the breach or to mitigate that harm;
- A description of the steps that the organization has taken or intends to take to notify affected individuals of the breach in accordance with subsection 10.1(3) of PIPEDA; and
- The name and contact information of a person who can answer the commissioner’s questions about the breach on behalf of the organization.
Notifying Affected Individuals
Determining Whether a Real Risk of Significant Harm Exists
Chicopee will assess the following factors when determining whether a security breach constitutes a real risk of significant harm to an individual or individuals:
- The sensitivity of the personal information involved in the breach;
- The probability that the personal information has been, is being, or will be misused; and
- Any other prescribed factor.
Notifications
Director, Finance is responsible for ensuring that all individuals for whom the breach creates a real risk of significant harm are notified at the earliest available opportunity, subject to any legal restrictions, in a form of communication that a reasonable person would consider appropriate in the circumstances. As per the regulation, notifications shall contain sufficient information to allow the individual to understand the significance to them of the breach, including:
- A description of the circumstances of the breach;
- The date on which or period during which the breach occurred or if neither is known the approximate period;
- A description of the personal information that is the subject of the breach to the extent that the information is known;
- A description of the steps that the organization has taken to reduce the risk of harm that could result from the breach;
- A description of the steps that affected individuals could take to reduce the risk of harm that could result from the breach or to mitigate that harm;
- Contact information that the affected individual can use to obtain further information about the breach; and
- Any other prescribed information.
The notice shall be conspicuous and given directly or indirectly to the individual in the prescribed form and manner as legislatively required as the situation dictates.
In addition to the individuals affected by the breach, Chicopee may notify other parties of the breach or disclose personal information relating to the breach, subject to the following guidelines:
- Chicopee will notify other organizations, government institutions, or parts of government institutions if Chicopee believes that doing so can reduce or mitigate the harm from the breach.
- Chicopee may disclose personal information without the knowledge or consent of the individual if:
- The disclosure is made to the other organization, the government institution, or the part of a government institution that was notified under the breach; and
- The disclosure is made solely for the purpose of reducing the risk of harm to the individual that could result from the breach or mitigating that harm.
Employee Personal Files
Employee information is recorded and stored in a variety of forms and necessary to conduct normal business. These include:
- In employee files contained in locked filling cabinets in the administration office and/or office of the CEO
- Electronic Files located in the Human Resource Directory on the Chicopee skiserver. This directory is only accessible by the CEO, Director Finance and the Director Guest Experience and Director, Finance.
- Electronic Files are also located in Dayforce, Chicopee’s payroll system and HRdownloads Chicopee online training platform. Access to information is controlled through security with Dayforce and HRdownloads managed by the Director Finance.
- Employees may request to the CEO (all Permanent Full and Part-time employees) or the Director of Finance (all other employees) to review their personnel file. Employees shall provide at least twenty-four (24) hours notice in order to access their file. Employees may request any copies of documents they have previously signed or required by law. No material in the file may be removed. Viewing of the file will be done under the supervision of the CEO or Director Finance.
- Employee files are the property of Chicopee.