Municipal
Government provides a broad range of services to its citizens. To provide these services, the City collects
personal information. This Directive
describes why this information is collected, how it is used, whom it will be
disclosed to, and how this information will be protected from unauthorized use.
The
City of Whitehorse is committed to maintaining the accuracy, confidentiality,
security and privacy of customer and employee personal information. This is
reflected in existing privacy and confidentiality provisions found in various
organizational policies and in standards of practice adopted by our business
models. The City and its employees also
reflect it in the high regard and trust with which customers and employees view
the management of personal information.
The
City of Whitehorse’s Administrative Directive on Protection of Personal
Information is a formal statement of principles and guidelines concerning the
minimum requirements for the protection of personal information for our
customers and employees. The objective of the Directive is responsible and
transparent practices in the management of personal information, in accordance
with Federal legislation.
Bill C-6: Personal Information Protection and Electronic Documents Act
Municipal Act
Employee Code of Conduct Policy
1.
Accountability: An organization is responsible for personal information
under its control and shall designate an individual or individuals who are
accountable for the organization's compliance with the following principles.
2. Identifying Purposes: The purposes for which personal information is
collected shall be identified by the organization at or before the time the
information is collected.
3. Consent: The knowledge and consent of the individual are required for
the collection, use or disclosure of personal information, except where
inappropriate.
4. Limiting Collection: The collection of personal information shall be
limited to that which is necessary for the purposes identified by the
organization. Information shall be collected by fair and lawful means.
5. Limiting Use, Disclosure, and Retention: Personal information shall
not be used or disclosed for purposes other than those for which it was collected,
except with the consent of the individual or as required by law. Personal
information shall be retained only as long as necessary for the fulfillment of
those purposes.
6. Accuracy: Personal information shall be as accurate, complete, and
up-to-date as is necessary for the purposes for which it is to be used.
7. Safeguards: Personal information shall be protected by security
safeguards appropriate to the sensitivity of the information.
8. Openness: An organization shall make readily available to individuals
specific information about its policies and practices relating to the
management of personal information.
9. Individual Access: Upon request, an individual shall be informed of
the existence, use and disclosure of his or her personal information and shall
be given access to that information. An individual shall be able to challenge
the accuracy and completeness of the information and have it amended as
appropriate.
10. Challenging Compliance: An individual shall be able to address a
challenge concerning compliance with the above principles to the designated
individual or individuals accountable for the organization's compliance.
The
10 principles that form the basis of this directive are interrelated and the
City shall adhere to the 10 principles as a whole. Each principle must be read
in conjunction with the accompanying commentary. The scope and application of the Directive are as follows:
Collection - the act of gathering, acquiring,
recording or obtaining personal information from any source, including third
parties, by any means.
Consent - voluntary agreement with the
collection, use and disclosure of personal information for defined purposes.
Consent can be either express or implied and can be provided directly by the
individual or by an authorized representative. Express consent can be given
orally, electronically or in writing but is always unequivocal and does not
require any inference on the part of the City of Whitehorse. Implied consent is
consent that can reasonably be inferred from an individual’s action or
inaction.
Customer
- an individual who:
(a) uses, or applies to use, the services of
the City or any goods purchased from the City;
(b) corresponds with the City; or
(c) enters any contest sponsored by the City.
Disclosure
- making personal
information available to a third party.
Designated
Officer – A person
designated by the City of Whitehorse to oversee compliance to this policy.
Employee
- an employee of the
City of Whitehorse.
Personal information - information about an identifiable
individual but not aggregated information that cannot be associated with a
specific individual.
For a customer, such information
includes application for services,
grant application, billing information, recorded complaints, contact
information, and etcetera.
For an employee, such information includes
information found in personal employment files, performance appraisals and
medical and benefits information.
Third party - an individual other than the customer
or his agent or an organization other than The City of Whitehorse
Use - the treatment, handling, and management of personal
information by the City of Whitehorse.
The City of Whitehorse is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.
1.1
Responsibility
for ensuring compliance with the provisions of the Directive rests with the
designated officer of the City, which has designated the City Manager as the
person to be accountable for compliance with the Directive.
1.2
Other
individuals within The City of Whitehorse may be delegated to act on behalf of
the designated person(s) or to take responsibility for the day-to-day
collection and processing of personal information.
1.3
The City of
Whitehorse shall make known, upon request, the title of the person or persons
designated to oversee their compliance with the Directive.
1.4
The City of
Whitehorse is responsible for personal information in their possession or
control, including information that has been transferred to a third party for
processing. The City of Whitehorse shall use appropriate means to provide a
comparable level of protection while information is being processed by a third
party (see Principle 7).
1.5
The City of
Whitehorse has designated the City Manager as its Privacy Official to oversee
compliance with the Directive. The Privacy Official may be contacted at:
City of Whitehorse
2121 Second Avenue
Whitehorse, Y.T.
Y1A 1C2
Attention: City Manager, Privacy Official
Or telephone: 1-867-668-8650
The purposes for which personal information is collected shall be identified by the City of Whitehorse at or before the time the information is collected.
2.1
The City of
Whitehorse shall collect personal information only for the following purposes:
a)
To
establish and maintain responsible commercial relations with customers and to
provide ongoing service;
b)
To
understand customer needs;
c)
To develop,
enhance, market or provide municipal products and services;
d)
To manage
and develop their business and operations, including personnel and employment
matters; and
e)
To meet
legal and regulatory requirements.
Further references to
“identified purposes” mean the purposes identified in this Principle
2.2
The City of
Whitehorse shall specify orally, electronically or in writing the identified
purposes to the customer or employee at or before the time personal information
is collected. Upon request, persons collecting personal information shall
explain these identified purposes or refer the individual to a designated
person within the City who shall explain the purposes.
2.3
Unless
required by law, the City of Whitehorse shall not use or disclose, for any new
purpose, personal information that has been collected without first identifying
and documenting the new purpose and obtaining the consent of the customer or
employee.
2.4
The City of
Whitehorse shall compile a list of sources for which personal information is
collected. This list shall identify what
information is collected, why it is required, what it will be used for, and how
the information is accessed.
The
knowledge and consent of the individual are required for the collection, use or
disclosure of personal information, except where inappropriate.
Note: In certain circumstances personal
information can be collected, used or disclosed without the knowledge and
consent of the individual. For example, the City of Whitehorse may collect or
use personal information without knowledge or consent if it is clearly in the
interests of the individual and consent cannot be obtained in a timely way,
such as when the individual is a minor, seriously ill or mentally
incapacitated.
3.1
The City of
Whitehorse may also collect, use or disclose personal information without
knowledge or consent in the following circumstances:
a)
if seeking
the consent of the individual might defeat the purpose of collecting the
information such as in the investigation of a breach of a bylaw or agreement or
a contravention of a federal or provincial law.
b)
in the case
of an emergency where the life, health or security of an individual is
threatened, or appears to be threatened.
c)
The City of
Whitehorse may disclose personal information without knowledge or consent to a
lawyer representing the companies, to collect a debt, to comply with a
subpoena, warrant or other court order, or as may be otherwise required by law.
3.2
In
obtaining consent, The City of Whitehorse shall use reasonable efforts to
ensure that a customer or employee is advised of the identified purposes for
which personal information will be used or disclosed. Purposes shall be stated
in a manner that can be reasonably understood by the customer or employee.
3.3
Generally,
The City of Whitehorse shall seek consent to use and disclose personal
information at the same time it collects the information. However, the City may
seek consent to use and disclose personal information after it has been
collected - but before it is used or disclosed for a new purpose.
3.4
The City of
Whitehorse will require customers to consent to the collection, use or
disclosure of personal information as a condition of the supply of a service
only if such collection, use or disclosure is required to fulfill the
identified purposes, or will allow for the better management of that service.
3.5
In
determining the appropriate form of consent, The City of Whitehorse shall take
into account the sensitivity of the personal information and the reasonable
expectations of its customers and employees.
3.6
In general,
the use of services by a customer, or the acceptance of employment or benefits
by an employee, constitutes implied consent for the City of Whitehorse to
collect, use and disclose personal information for all identified purposes.
3.7
A customer
or employee may withdraw consent at any time, subject to legal or contractual
restrictions and reasonable notice. Customers and employees may contact the
City for more information regarding the implications of withdrawing consent.
The
collection of personal information shall be limited to that which is necessary
for the purposes identified by the organization. Information shall be collected
by fair and lawful means.
4.1
The City of
Whitehorse collects personal information primarily from their customers or employees.
4.2
The City of
Whitehorse may also collect personal information from other sources including
other government agencies, employers or personal references, or other third
parties that represent that they have the right to disclose the information.
4.3
The type
and scope of information collected should be consistent with what the
information will be used for.
Personal
information shall not be used or disclosed for purposes other than those for
which it was collected, except with the consent of the individual or as
required by law. Personal information shall be retained only as long as
necessary for the fulfilment of those purposes.
5.1
In certain
circumstances personal information can be collected, used or disclosed without
the knowledge and consent of the individual. (See Note - Principle 3)
5.2
In
addition, The City of Whitehorse may disclose a customer’s personal information
to:
a) another Government agency for the effective provision of a municipal or government services;
b)
a company
involved in supplying the customer with municipal services;
c)
another
person for the development, enhancement, marketing or provision of any of the
products or services of The City of Whitehorse;
d)
an agent
retained by The City of Whitehorse in connection with the collection of the
customer's account;
e)
credit
grantors and reporting agencies;
f)
a person
who, in the reasonable judgment of the City of Whitehorse, is seeking the
information as an agent of the customer; and
g)
a third
party or parties, where the customer consents to such disclosure or disclosure
is required by law.
5.3
The City of
Whitehorse may disclose personal information about its employees:
a)
for normal
personnel and benefits administration;
b)
in the
context of providing references regarding current or former employees in
response to requests from prospective employers; or
c)
where
disclosure is required by law.
5.4
Only those
employees of The City of Whitehorse who require access for business reasons, or
whose duties reasonably so require, are granted access to personal information
about customers and employees.
5.5
The City of
Whitehorse shall keep personal information only as long as it remains necessary
or relevant for the identified purposes or as required by law. Depending on the
circumstances, where personal information has been used to make a decision
about a customer or employee, The City of Whitehorse shall retain, for a period
of time that is reasonably sufficient to allow for access by the customer or
employee, either the actual information or the rationale for making the
decision.
5.6
The
City of Whitehorse shall maintain reasonable and systematic controls, schedules
and practices for information and records retention and destruction, which
applies to personal information, that is no longer necessary or relevant for
the identified purposes or required by law to be retained. Such information
shall be destroyed, erased or made anonymous.
5.7
Additional
Information about retention and destruction of personal information is also
governed by the Administrative Directive on “Records Retention and
Destruction”.
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
6.1
Personal
information used by The City of Whitehorse shall be sufficiently accurate,
complete and up-to-date to minimize the possibility that inappropriate
information may be used to make a decision about a customer or employee.
6.2
The City of
Whitehorse shall update personal information about customers and employees as
and when necessary to fulfill the identified purposes or upon notification by
the individual.
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
7.1
The City of
Whitehorse shall protect personal information against such risks as loss or
theft, unauthorized access, disclosure, copying, use, modification or
destruction, through appropriate security measures. The City shall protect the
information regardless of the format in which it is held.
7.2
The City of
Whitehorse shall protect personal information disclosed to third parties by
contractual agreements stipulating the confidentiality of the information and
the purposes for which it is to be used.
7.3
All
employees of the The City of Whitehorse with access to personal information
shall be required as a condition of employment to respect the confidentiality
of personal information.
An
organization shall make readily available to individuals specific information
about its policies and practices relating to the management of personal information.
8.1
The City of
Whitehorse shall make information about its policies and practices easy to
understand, including:
a)
The title
and address of the person or persons accountable for the companies’ compliance
with the Directive and to whom inquiries or complaints can be forwarded;
b)
The means
of gaining access to personal information held by the companies; and
c)
The City of
Whitehorse shall compile an inventory of personal information collected. For each type of information, the following
shall be identified:
8.2
The City of
Whitehorse shall make available information to help customers and employees
exercise choices regarding the use of their personal information and the
privacy-enhancing services available from the company.
Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
9.1
Upon
request, The City of Whitehorse shall afford to a customer or an employee a
reasonable opportunity to review the personal information in the individual’s
file. Personal information shall be provided in understandable form within a reasonable
time and at minimal or no cost to the individual.
9.2
In certain
situations, The City of Whitehorse may not be able to provide access to all of
the personal information that they hold about a customer or employee. For
example, The City of Whitehorse may not provide access to information if doing
so would likely reveal personal information about a third party or could
reasonably be expected to threaten the life or security of another individual.
Also, the City of Whitehorse may not provide access to information if
disclosure would reveal confidential information, if the information is
protected by solicitor-client privilege, if the information was generated in
the course of a formal dispute resolution process, or if the information was
collected in relation to the investigation of a breach of an agreement or bylaw
or a contravention of a federal or provincial law. If access to personal
information cannot be provided, The City of Whitehorse shall provide the
reasons for denying access upon request.
9.3
Upon request,
The City of Whitehorse shall provide an account of the use and disclosure of
personal information and, where reasonably possible, shall state the source of
the information. In providing an account of disclosure, the City shall provide
a list of organizations to which it may have disclosed personal information
about the individual when it is not possible to provide an actual list.
9.4
In order to
safeguard personal information, a customer or employee may be required to
provide sufficient identification information to permit the City to account for
the existence, use and disclosure of personal information and to authorize
access to the individual’s file. Any such information shall be used only for
this purpose.
9.5
The City of
Whitehorse shall promptly correct or complete any personal information found to
be inaccurate or incomplete. Any unresolved differences as to accuracy or
completeness shall be noted in the individual’s file. Where appropriate, the
City of Whitehorse shall transmit to third parties having access to the
personal information in question any amended information or the existence of
any unresolved differences.
9.6 A customer can obtain information or seek access to his or her individual file by contacting a designated representative at the City, wherever the said file is located. An employee can obtain information or seek access to his or her individual file by contacting his or her immediate supervisor within the City or the manager of the Human Resources Department
An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization's compliance.
10.1 The City of Whitehorse shall maintain
procedures for addressing and responding to all inquiries or complaints from
its customers and employees about the companies’ handling of personal
information.
10.2 The City of Whitehorse shall inform
their customers and employees about the existence of these procedures as well
as the availability of complaint procedures.
10.3 The person or persons accountable for
compliance with the Directive may seek external advice where appropriate before
providing a final response to individual complaints.
10.4 The City of Whitehorse, as the case may
be, shall investigate all complaints concerning compliance with the Directive.
If a complaint is found to be justified, the company shall take appropriate
measures to resolve the complaint including, if necessary, amending its
administrative directive and procedures. A customer or employee shall be
informed of the outcome of the investigation regarding his or her complaint.
10.5 If the complaint is not resolved to the
satisfaction of the complainant, they may forward their complaint to the
Privacy Commissionaire. Types of
complaints normally handled by the Commissionaire include:
a)
Denial of
individual access to information
b)
Improper
collection, use or disclosure of information
c)
Refusal to
correct inaccurate or incomplete information
d)
Failure to
provide access to personal information in an alternative format to an
individual with a sensory disability
e)
Inappropriate
safeguards to the protection of personal information
10.6 The Privacy commissionaire can be
contacted at:
The Office of the Privacy Commissioner of
Canada
112 Kent Street
Ottawa, Ontario K1A 1H3
Telephone 1-(800) 282-1376
Web: www.privcom.gc.ca
Email: info@privcom.gc.ca
______________________________________________________________________________
For
more information on the commitment of The City of Whitehorse to privacy,
contact them at the number shown for the privacy official or contact them
through the following website:
www.city.whitehorse.yk.ca
Original signed by
Bill Newell