The purpose of this policy is to establish procedures for the use, collection, and release of personal information collected and maintained by Youville Centre.
Youville Centre has a separate Privacy Policy: Privacy of Personal Health Information which governs our practices with regard to the personal health information we collect, use and disclose specific to our services to clients.
This policy applies to our clients, donors, staff, volunteers, and Board members and describes the principles Youville Centre will use to protect the privacy of personal information, no matter how the information is collected, used or disclosed.
We value the trust of those we deal with, and of the public, and recognize that maintaining this trust requires that we be transparent and accountable in how we treat the information that they choose to share with us.
During the course of our various projects and activities, we frequently gather and use personal information. Anyone from whom we collect such information should expect that it will be carefully protected and that any use other than for which it was originally gathered or other dealings with this information be subject to consent. Our privacy practices are designed to achieve this. We do not sell, rent, or release any lists for private commercial purposes.
DEFINITION OF TERMS:
Definitions
Board Member – A Director and policy maker of Youville Centre.
Client – child or youth receiving programs and/or services at Youville Centre
Donor – Any individual or organization that contributes funds to Youville Centre.
Personal Information – Personal information has the same meaning as in the Freedom of Information and Protection of Privacy Act and is defined as recorded (or unrecorded) information about an identifiable individual. Any information that can be used to distinguish, identify or contact a specific individual. This information can include an individual’s opinions or views, as well as facts about, or related to, the individual. This personal information does not include business contact information or publicly available information.
Recorded Information- Information recorded in any format, such as paper records, electronic records, photographs, videos or maps.
Staff – Paid workers of Youville Centre.
Unrecorded Information – When a service provider is collecting information, the definition of personal information also includes personal information that is not recorded, such as information collected through an intake interview.
Stakeholder – person, group or organization that has interest or concern or relationship with Youville Centre (stakeholders for the purpose of this policy includes: employees, volunteers including Board of Directors, field placement students, clients, partners providing services to clients at Youville Centre)
Volunteer – Any individual who performs a service willingly without pay
“We”, “our” and “us” – means, as applicable, Youville Centre
PROCEDURES:
Our Privacy Principles
Youville Centre adheres to the ten principles outlined in the federal Personal Information Protection and Electronic Documents Act (PIPEDA). The Policy’s 10 principles are:
Principle 1 – Accountability
Youville Centre is accountable for all personal information in its possession or custody, including any personal information disclosed to third parties for processing or other administrative functions. Youville Centre has established policies and procedures to comply with this policy, and has designated a Chief Privacy Officer (Executive Director) to be accountable for compliance. To practice the principles of this policy, Youville Centre will:
• Inform all stakeholders of its Privacy of Information policies and procedures;
• Train staff and volunteers to understand and follow said policies and procedures;
• Establish policies and procedures to receive and respond to questions and complaints; and
• Oversee compliance with these policies and procedures through normal periodic audits.
Principle 2 – Identifying Purposes
Youville Centre will identify the purposes for which it collects personal information from stakeholders
before or when the information is collected. Specifically:
• Why Youville Centre needs the personal information it is requesting;
• How the personal information may be used with client consent for other purposes; and
• The fact that anyone can refuse, at any time, permission for us to use personal information for these or other purposes.
• We may collect and use personal information for but not limited to the following purposes:
For clients
• To inform treatment, academic and child development goals
• For public relations activities (see Policy: Use of Client Information for Public Relations Activities);
• For special internal events such as graduation; and
• To maintain a network of alumni.
For Management/Operational Responsibilities:
• To complete quality assurance tasks;
• To complete a self-assessment of the organization for accreditation purposes;
• To comply with the requirements of the accreditation process such as site visits and file audits;
• To maintain professional supervision of programs, services and employees; and
• To comply with financial audit requirements.
For our donors:
• To establish a relationship and to communicate;
• To understand donor identity and identify how we may improve our services to meet donor needs;
• To reach our fundraising goals;
• To process donations;
• To provide donors with information about Youville Centre;
• To respond to donor requests for information; and
• To recognize individual donations publicly with the donor’s consent.
For our staff and volunteers:
• To recruit, train, recognize and retain highly qualified and motivated individuals;
• To establish and maintain harmonious employer-staff relations;
• To administer Youville Centre policies and procedures; and
• To manage and promote the philanthropic activities of Youville Centre.
Principle 3 – Consent
• We will make a reasonable effort to make sure all stakeholders understand how their personal information will be used by us;
• We will obtain consent from stakeholders before or when we collect or use personal information;
• A stakeholder’s consent can be express, implied, or given through an authorized representative;
• A stakeholder can express consent orally, in writing or electronically or imply consent through action or inaction. Express consent is the preferred format;
• We will seek consent to use and disclose personal information at the same time it is collected. Sometimes, however, we may identify a new purpose and we will seek consent to use and disclose personal information for that purpose, after the information has been collected;
• A client can also give consent through an authorized representative, such as a legal guardian or a person with a power of attorney. This is necessary, for example, if we cannot obtain express consent from a person who is a minor, seriously ill, or mentally incapacitated;
• Before deciding what form of consent is appropriate, we will consider the type of personal information needed and the reason for its use; and
• We can collect or use personal information without the knowledge and consent of clients in exceptional circumstances where such collection or use is permitted or required by law.
Documentation of Consent to Disclose Personal Information
If applicable, when releasing or exchanging personal information, Youville Centre documents the person’s or persons’ express consent, including: (Release and Exchange of Personal Information Form)
• Their name;
• Organization and staff person’s name;
• Name of person or organization to which the information is being released;
• Specific information being released;
• Date of consent; and
• Any limits on the consent (for example: time period for consent, special conditions).
Exceptional Circumstances
We may use personal information even when an individual expressly instructs otherwise when the use is necessary to assess, reduce or eliminate a risk of serious harm to a person or group, or, if the service provider is a children’s aid society, where reasonably necessary to assess, reduce or eliminate a risk of harm to a child. Youville Centre can disclose personal information without the knowledge and consent of clients in exceptional circumstances where such disclosure is permitted or required by law. For example, we will not ask for consent when personal information is collected for the purpose of providing a service:
- To the Ministry of Children, Community and Social Services;
- To Prescribed Entities;
- To a law enforcement agency in Canada to aid an investigation or to allow the agency to determine whether to undertake an investigation;
- To a legal representative in certain circumstances for a legal proceeding;
- To contact a relative, friend or potential SDM in the case of an emergency (e.g. injury of an individual);
- To assess, reduce or eliminate a risk of serious harm;
- By one children’s aid society or child welfare authority outside of Ontario from another society if reasonably necessary to assess, reduce or eliminate a risk of harm to a child;
- To a potential successor of the service provider; and
- By law, treaty, agreement or arrangement made under a provincial or federal Act.
Reasons could include but are not limited to;
- Comply with a subpoena or warrant;
- Respond to a lawful authority for lawful purposes;
- Facilitate the activities of an investigative body or government institution in dealing with a past, potential or actual breach of an agreement or contravention of the laws of Canada or a province;
- Comply with the law; and
- Quality Assurance purposes eg. accreditation.
Principle 4 – Limiting Collection
Youville Centre limits the amount and type of personal information it collects. We will collect:
• Personal information using policies and procedures which are fair and lawful; and
• Only the amount and type of information needed for the purposes documented by us and identified to clients.
Principle 5- Limiting Use, Disclosure, and Retention
• Personal information may not be used for purposes other than those for which it was originally collected, unless it has first obtained consent; and
• We retain personal information only for as long as it is needed and only for the fulfillment of the purposes for which it was originally collected.
Principle 6 – Accuracy
• We will keep personal information as accurate, complete and current as necessary for the identified purposes for which it was collected;
• All stakeholders may, in writing, challenge the accuracy and completeness of their personal information and request that it be amended as appropriate;
• Youville Centre will update personal information only if it is necessary for the purposes for which it was collected;
• We will rely on all stakeholders to keep certain personal information accurate, complete, and current; and
• If a stakeholder shows that personal information is inaccurate, incomplete, out of date, or irrelevant, we will revise the personal information.
Principle 7 – Safeguards
• We protect personal information with safeguards appropriate to the sensitivity of the information;
• We safeguard personal information from loss or theft, and from unauthorized access, disclosure, duplication, use, or modification;
• Access to personal information is restricted to Youville Centre staff, volunteers, and authorized service providers who need it to do their jobs;
• Youville Centre safeguards vary depending on the sensitivity, amount, distribution, format, and storage of the personal information. We give the highest level of protection to the most sensitive personal information; and
• We safeguard personal information through security measures. For example:
o Physical security, such as secure locks on filing cabinets and restricted access to offices;
o Organizational security, such as a controlled entry in data bases and limited access to relevant information;
o Electronic security, such as strong passwords, personal identification numbers, and encryption;
o Informing staff regularly about its policies and procedures for protecting personal information, and emphasizing the importance of complying with them; and
o As a condition of employment, our staff is required to conform to Youville Centre policies and procedures.
Website and Electronic Commerce
• We do not automatically gather any personal information such as client name, phone number, e-mail or address through our website. This information is only obtained if it is supplied voluntarily, through contacting us via e-mail, or by asking to receive electronic newsletters or other information;
• Any personal information provided to us will not be sold to any third party;
• We use software that receives and records the Internet Protocol (IP) address of the computer that has contacted our web-site. We make no attempt to link these addresses with the identity of individuals contacting our site. The information is used to improve the content of and/or measure the level of interest in our site and is not shared with other organizations;
• Whenever we enable “cookies” to facilitate our transactions, we will first inform the client;
• If stakeholders choose to participate in an online forum or discussion group, we may ask that they volunteer personal information such as name and e-mail address for the purposes of effective administration of the forum or discussion group; and
• We will not disclose this information to anyone outside of Youville Centre without prior consent.
Principle 8 – Openness
• Youville Centre is transparent about the policies and procedures it uses to manage personal information by posting this policy on its website; and
• The information is made available in a manner that is accessible and easy to understand.
- Principle 9 – Individual Access
• Stakeholders have the right to know what personal information is held by us;
• Stakeholders have a right, upon written request, to access their own personal information, and to know to which third parties the information has been disclosed;
• We will respond to written requests within 30 days of the request or immediately should a person’s safety and/or the safety of another person be of concern; - Stakeholders will review their file in the presence of a Youville Centre staff member;
- Stakeholders can challenge the accuracy of the personal information and request amendments;
- In certain situations, we may not be able to provide access to all the personal information we hold about a client. Exceptions will be limited and specific as permitted or required by law; and
- Where permitted, the reasons for denying access will be provided to individuals upon written request to Youville Centre Privacy Officer (Executive Director).
Principle 10 – Challenging Compliance
• A stakeholder may challenge our compliance with this policy. We have policies and procedures to receive, investigate, and respond to complaints and questions;
• Youville Centre will investigate all complaints and if it finds a complaint justified, we will try to resolve it; and
• If necessary, we will take appropriate measures, including changing policies or procedures, to ensure that other persons will not experience the same problem.
Exceptions
Some groups, such as law enforcement agencies, have a lawful or investigative need to collect, use and disclose personal information without having to obtain the consent of the concerned individuals. For these reasons, certain exceptions are included:
• If the action clearly benefits the individual or if obtaining permission could infringe on the information’s accuracy;
• When such data can contribute to a legal investigation or aid in an emergency where people’s lives and safety could be at stake; and
• If disclosure aids, in times of emergency, matters of legal investigation, or facilitates the conservation of historically important records.