Policy and Procedures: Privacy Policy

Introduction

To outline your rights as a Member in this connection, and also your obligations to respect the privacy of personal information of your fellow Members. In carrying out your duties as an officer, you are to assure and to demonstrate to your fellow members that you, and this corporation, respect their privacy rights.

These policies and practices will comply with the letter, spirit, and intent of the federal Personal Information Protection Documents Act (PIPEDA) and any applicable provincial privacy act (referred to below collectively as ‘the Act”).

The purpose of the Act is to establish rules to govern the collection, use, and disclosure of personal information, to recognize the right of privacy, and to recognize the need of organizations to collect, use, or disclose personal information.

This policy has been developed and is consistent with policies adopted by other Corporations. The policy applies to the H.K.V.C.A. only, and responsibility for compliance with the policy lies with this corporation.

This corporation respects the privacy of our members, indeed that of all individuals. It is committed to maintaining accurate, confidential, secure, and private personal information in our files.

What is Personal Information?

Personal information includes any factual or subjective information, recorded or not, about an individual. This includes such information as:

• Age, employee numbers, income, or ethnic origin

• Evaluations, comments or disciplinary actions

• Credit records, medical records, intentions (for example, to change jobs)

Personal information does not include the name, title, business address, or business telephone number of a member.

Privacy Principles

1. The HKVCA is accountable to its members.

It will:

• Comply with all 10 of the principles listed above
• Protect all personal information held by this corporation.

2. Identifying Purposes:

It will:

- Identify why your personal information is needed and how it will be used.

a) Application Information - Reason:

i} Ontario Corporations Act requires that an accurate list of shareholders (members) be maintained

ii} Mailing purposes

b) Computer and e-mail Access

HKVCA will ensure that neither internet nor access of any kind will be granted for purposes other than HKVCA internal needs.

3. This Corporation will obtain consent to use personal information.

It will obtain member’s consent before, or at the time of collection, as and when a new use is identified for information already collected. This consent will be obtained in written form.

Personal information collected about you during the course of your membership is subject to the Act. Members may withdraw consent to use information for specific purposes by making a request in writing to any member of your Board of Directors or Region Council.

4.  This corporation limits collection of personal Information

Information shall be collected by fair and lawful means. The corporation

• Does not and will not collect personal information indiscriminately, but only as necessary for the purposes of facilitating the member relationship
• Does not and will not deceive or mislead members about the reasons for collecting personal information.
• To keep personal information only as long as necessary to satisfy the purposes for which it was collected

Each member is obligated to honour these policies in dealing with such information from your fellow members.

5. This corporation limits use, disclosure, and retention of personal information

This corporation will:

• Use or disclose personal information only for the purpose for which it was collected, unless consent is given, or that use or disclosure is authorized by law
• Use or disclose information under court order
• To keep personal information only as long as necessary to satisfy the purposes for which it was collected
• Destroy, erase, or render anonymous information that is no longer required for an identified purpose or a legal requirement
• Put guidelines and procedures in place for retaining and destroying personal information

Where personal information is disclosed or transferred to third party organizations performing services on behalf of this corporation (e.g. special mailings), the privacy and confidentiality of your personal information will be maintained through contractual agreement with these organizations. These arrangements strictly prohibit sale or disclosure of your personal information to any other party, except where it is providing sub-contracted services covered under the main agreement.

To the extent required by law, information will be retained after membership expires. For example, some data must be retained for up to seven years.

Information whose retention is not required by law will be regularly reviewed and destroyed, when no longer required for business purposes.

6.  This Corporation keeps personal Information up to date and accurate.

This corporation will:

• Minimize the possibility of using incorrect information when making a decision about any member, or when disclosing information to third parties.
• Correct or amend any personal information, it its accuracy and completeness is challenged and found to be deficient.
• Members are responsible for advising their Region Council, in writing, of any inaccuracies or changes in their own personal information (e.g. change of address or telephone number, or other changes that affect legal status, etc.) in order to keep that accurate and up to date.

7. Safeguards - The security of your personal information is our priority.

This corporation safeguards personal information under its control in a manner appropriate to the sensitivity of the information including:

• safeguarding the information from unauthorized access, disclosure, copying, use or modification
• protecting it against loss or theft
• protecting it regardless of the format in which it is held.

Personal information in documentary form is and will continue to be maintained in a secure, locked area. Computerized personal information is and will continue to be maintained in secure files with limited, password protected access.

As a Member, you are responsible to observe all such privacy policies and practices respecting the personal information of your fellow members. Officers are permitted only as authorized to collect, use, or disclose the personal information of others. If you discover or uncover personal information that is not properly safeguarded, you should immediately notify a Director. Members entrusted with confidential personal information of others must be sure to observe appropriate procedures. You should not disclose or release such information casually to the subject of that information, but only after proper process that may even include written request and identification proof, and personal delivery in sealed envelopes marked "Confidential". In responding to personal information access. Requests by any agency, you cannot contravene another person's privacy and confidentiality, (e.g. you cannot give out information which also includes, that of other members (in those, cases, you may be able, and obligated, to issue that with the sections involving another person either blocked out or deleted, and that it must be done with great care, so as not to directly or indirectly reveal the identity of that other person or any personal information about them).

8.  This corporation is open about its privacy and security policy.

This corporation will:

• When requested, inform members that it has policies and practices for the management of personal information.
• Make these policies and practices understandable and easily available.

*** membership forms should contain an “acknowledgment statement” that the applicant agrees to the use of the personal information enclosed in accordance with Corporate Policy, and a address where he/she can apply for a record of what we have on file.***

9. This corporation provides access to a member on his or her personal information.

This corporation will:

• When requested, inform members if and what it has as to any personal information about them.
• Explain how it is, or has been, used and provide a list of any organizations to which it has been disclosed.
• Give members access to their information.
• Subject to the provisions of the law, provide a copy of the ‘information requested, or reasons for not providing access.

10. Challenging Compliance

If they wish, an individual may challenge this corporation’s compliance with the above principles through the Secretary or their designated representative.

Members should direct any requests and complaints relating to this corporation’s privacy policy or practices to the President or their designated representative.

If an individual’s privacy requests and concerns have not been addressed through this process, at their option, they may pursue that through contact with the governing Privacy Commissioner’s Office of their province (currently in Quebec, British Columbia, or British Columbia) or for Canada.