Université de Moncton’s commitment to protecting personal information
Université de Moncton is firmly committed to providing services of exceptional quality to its students as well as the institution as a whole; and its reputation of integrity touches upon all its activities. In this spirit, Université de Moncton respects the personal information of its students and the people who call on its services by following, or even surpassing, the obligations established by law in this respect. Our commitment to the protection of personal information is based on the following ten principles, laid out in the Canadian Standards Association Model Code for the Protection of Personal Information. Each principle is guaranteed by the Personal Information Protection and Electronic Documents Act (PIPEDA).
The definition of personal information” adopted in the present commitment is taken from the PIPEDA:
Principle 1 – Responsibility
1.1 Université de Moncton is responsible for the personal information it manages. This responsibility has lead Université de Moncton to designate a person who must ensure that the present policy and the acts that apply are respected. Any information request related to our personal information protection practices can be addressed to any Université de Moncton administrative staff member, or sent to the following applicable service:
1.2 Université de Moncton is responsible for the personal information it has in its possession or under its control, including information given to a third party for processing purposes. On rare occasions, we disclose personal information to a third party (apart from our own divisions and administrative services) for processing purposes but, if the occasion arises, we require that the organization afford the personal information the same protection it would receive if processed directly by Université de Moncton. We also require that the organization fully comply with the present policy.
1.3 The person in charge of the policy within Université de Moncton:
Université de Moncton
Moncton, New Brunswick
Telephone: (506) 858-4106
Fax: (506) 858-4538
Principle 2 – Identifying Purposes
2.1 When any personal information is collected, Université de Moncton will clearly indicate to the person concerned the purposes for which the information is intended. The people concerned will be informed of the goals in collecting the information in a manner that is clear, concise and understandable. Our administrative staff are well trained and informed regarding our personal information protection practices and will be able to offer additional information regarding collection purposes to the person making the request. This information can be provided orally or in writing, based on the manner in which the collection is carried out.
2.2 At any time, when the Université is planning to use the personal information for purposes that were not initially provided, it must first clarify the new purposes before using them and obtain the consent of the person concerned, unless new consent is not required by law.
2.3 Université de Moncton will keep a report indicating the purposes for which each piece of personal information has been used and to whom it could have been sent.
Principle 3 – Consent
3.1 Université de Moncton will inform any person and obtain their consent before collecting, using or disclosing personal information concerning them, except within the limits allowed by law. When the personal information is collected, Université de Moncton will attempt to obtain consent for any intended uses. Should this be impossible, Université de Moncton will obtain the informed consent of the person concerned before using the personal information. Furthermore, if Université de Moncton plans to use the personal information relating to a person for purposes for which it did not initially receive consent, it must obtain new consent.
3.2 In all cases consent means informed consent. When requesting consent, Université de Moncton will try, using all reasonable means, to inform the person concerned of all the purposes for which personal information is requested. In accordance with the requirements of Principle 2, those concerned will be informed of the intended uses for the information in a manner that is clear, concise and understandable.
3.3 Université de Moncton cannot, based on the reason that it provides a good or service, require a person to agree to the collection, use and disclosing of information other than that which is required to carry out clearly indicated purposes. This means that when consent is requested for information that isn’t essential to the providing of service, this information will be supplied voluntarily. The Université de Moncton policy makes provision for receiving consent and an option of acceptance for any incidental use of personal information. If it is necessary to obtain certain personal information regarding a person in order to provide a service, the person will be advised as well as informed of the reasons for which this information is necessary given the situation.
3.4 Under certain conditions, a person’s consent can be implicit depending on the circumstances. In these cases, the purposes for which this personal information is gathered and used must be clear, and Université de Moncton can only use this personal information for these clear purposes. For example, if a person asks that we send them a particular article, Université de Moncton needs their name and address in order to carry out their request. In this case, Université de Moncton can consider that the request by the person concerned constitutes consent for a specific purpose. Therefore we will only use this information in order to comply with the request.
3.5 Wherever practicable, the consent to collect, use and disclose personal information will be obtained in writing. Whether or not it’s necessary to obtain written consent can depend on the circumstances, the delicate nature of the information in question and the use for which it is intended. The consent requested by Université de Moncton can consist of various forms, based on the circumstances and type of information. In general, if the information is of a delicate nature, written consent will be obtained. If Université de Moncton requests consent from a person in order to procure information about them from a third party (e.g. credit references), it will require the person concerned to consent in writing in order to demonstrate consent, upon the request of the third party providing the information.
3.6 Université de Moncton will also take reasonable measures to determine if the person concerned is able to consent. For example, children are hardly in a position to accord their consent to collect, use and disclose information. Similarly, people with disabilities can find it difficult to consent, in such a case it may be necessary to obtain the consent of a guardian or agent.
3.7 There are some exceptions to the usual requirement to obtain consent from a person. This means that an organization can gather and use personal information in circumstances where the collection and/or use of such information is definitely in the interest of the person concerned, and where it was not possible to obtain his/her consent in a timely manner. Similarly, personal information regarding a person can be collected and used without consent if reasonable motives lead one to believe that this information is necessary to investigate the violation of an agreement or legislative infraction, and that obtaining consent could compromise the availability or exactitude of such information. Université de Moncton’s front-line employees cannot remove themselves from the obligation to obtain consent.
Principle 4 – Limiting Collection
4.1 Université de Moncton will not collect any person information that is not reasonably necessary for specific legitimate purposes and for which consent has not been obtained. Furthermore, all personal information will be honestly and legally collected.
Principle 5 – Limiting Use, Disclosure and Retention
5.1 Université de Moncton will use, disclose and conserve personal information only for the specific legitimate purposes clearly indicated to the person concerned and for which consent was obtained. The personal information will only be kept for the period of time required to carry out the specific purposes, except when legislation requires a longer period. Personal information having been used to make a decision about a person will be kept long enough to allow the person concerned to have access after the decision has been made. It’s possible for personal information to be kept incidentally due to routine backup operations of system files. If so, Université de Moncton cannot dispose of this personal information for use. Université de Moncton will draft guidelines and apply procedures for the storing of personal information.
5.2 Personal information that Université de Moncton no longer needs for specified purposes will be destroyed, erased or de-identified.
Principle 6 – Exactitude
6.1 The personal information collected, used and disclosed by Université de Moncton must be as exact, complete and up to date as required by the purposes for which it is used. The information being used to make a decision about a person will be as exact as possible. If Université de Moncton has doubts regarding the exactitude of a particular piece of information, it will not take this piece of information into account when making a decision about the person concerned.
6.2 Université de Moncton will not systematically update personal information, unless it is necessary to achieve the purposes for which it was collected. To update personal information or confirm reliability, Université de Moncton will contact the person concerned, unless it is not appropriate given the circumstances.
Principle 7 – Safeguards
7.1 Personal information will be protected using security measures that correspond with the delicate nature of the information. All personal information will be submitted to selective availability based on needs. All information will be protected through material means and the technical and administrative measures deemed appropriate given the delicate nature of the personal information involved. Any piece of information relating to a person’s health or financial situation will receive a high degree of protection that complies with, or is superior to, industry standards.
7.2 Université de Moncton will regularly submit its security measures to an external evaluation and make its staff aware of the importance of protecting the confidential nature of personal information.
7.3 Université de Moncton will carefully examine the process of eliminating personal information in order to make sure that it is adequately disposed of, in a manner that doesn’t compromise the security of such information, regardless of the form under which it is kept.
Principle 8 – Openness
8.1 Université de Moncton will provide any person making the request with precise information on its policies and practices concerning the management of personal information. This information will be available on each of the Université de Moncton branch websites, at each of its campuses and, upon request, for each member of Université de Moncton’s administrative staff.
8.2 The information that Université de Moncton will make available to interested individuals concerning its personal information management policies will include:
• The name, title and address of the person in charge of Université de Moncton’s policies and practices, and to whom complaints and information requests can be sent.
• The means of acquiring access to personal information that Université de Moncton possesses.
• A description of the type of personal information that Université de Moncton possesses, including an overview of its use.
• The nature of the personal information that’s sent to its divisions and administrative services.
Principle 9 – Individual Access
9.1 Université de Moncton must inform any person making the request of the existence of personal information regarding them, of what it is used for and of it having been sent to a third party, and allow the person to consult it. The exactitude and the completeness of the information may also be contested and appropriate corrections made. If, in the eyes of Université de Moncton, the information is exact, the person concerned can attach their comments regarding the alleged inexactitude to the personal information concerning them.
9.2 A person who asks Université de Moncton to consult personal information about them, or who asks if it possesses personal information about them, can be required to provide enough information about their identity for it to be able to search for this personal information. The information provided in this manner will be used only for this purpose and will be destroyed as soon as possible after the search has been carried out.
9.3 If possible, Université de Moncton will provide any person making the request with the source of any personal information concerning them, the use that is made of this information and to whom it could have been sent.
9.4 Université de Moncton will answer any request for information within a reasonable time period and without charge. The information requested will be given to the person concerned or made available to them in a generally understandable form.
9.5 When a person demonstrates that the personal information is inaccurate or incomplete, Université de Moncton will make the necessary changes to this information. Depending on the nature of this information that constitutes the objection, Université de Moncton will correct, delete or add information. Where applicable, the modified information will be sent to third parties with access to the information in question. When a disagreement hasn’t been settled to the satisfaction of the person concerned, Université de Moncton must register the substance of the rejected complaint. If required, third parties having access to the information in question should be informed of the fact that the disagreement has not been settled.
Principle 10 – Challenging Compliance
10.1 Anybody who has concerns about Université de Moncton’s practices regarding personal information management, or regarding the way the personal information about them was collected, used or disclosed, will be able to talk about it with a member of Université de Moncton’s administrative staff. If the questions raised are not immediately resolved to the satisfaction of the interested party, the case will be immediately referred to the person responsible for the protection of personal information within Université de Moncton. The employee in charge of protecting personal information will investigate the concerns of the person interested and attempt to resolve any complaint as quickly and fairly as possible. If a complaint is determined to be valid, Université de Moncton will take the appropriate measures, including changing its policies and practices if required. If a complaint is determined to be unfounded, the person concerned will be advised of this conclusion and of his/her right to seek redress with the Office of the Privacy Commissioner.
10.2 The procedure regarding complaints will be sent to any person who expresses concerns and, if need be, explained in person.
Adopted at the CGV-040424