Privacy Policy

Policy name (s): Protection of Personal Information Policy

Initial approval by the Board of Directors: February 4, 2025

Updated on: February 12, 2025

Legal framework: Chapter P-39.1 - Act Respecting the Protection of Personal Information in the Private Sector

Other applicable policies and/or procedures: Confidentiality Policy and Agreement, Client Consent Form, Applicant Consent Form, Employee Consent Form

1. Definitions

Personal Information

Any information, regardless of the form or medium used to hold this information, which is about a natural person and allows that person to be identified, directly or indirectly. Personal data may include, among others:

Racial or ethnic origin
Political opinions
Religious or spiritual beliefs
Trade union membership
Genetic data
Health information
Sexual orientation
IP Address
Home address

The Act

The Act refers to chapter P-39.1, the Act Respecting the Protection of Personal Information in the Private Sector and the modifications made to modernize the Act.

Medium Used

Any form used to hold information, whether written, graphic, taped, filmed, computerized, or other.

Members

Any members of the Gaspésie Literacy Council, as defined in their by-laws.

Employee

An employee is anyone who is remunerated by the Gaspésie Literacy Council on a regular basis in exchange for achieving specific, pre-identified objectives.

Volunteers

Any person who conducts work on behalf of the Gaspésie Literacy Council or actively supports the achievement of its mission, but is not remunerated.

Patrons

In the context of this policy, a patron is any natural person, including but not limited to, employees, volunteers, members, learners, contractors, clients, donors, or participants who support the Gaspésie Literacy Council. In addition to those already mentioned, patrons include suppliers, consultants, any person who benefits from activities at the Gaspésie Literacy Council, or who provides services or supplies to the Gaspésie Literacy Council.

Applicants

Any person who is interested in becoming an employee, learner or a volunteer of the Gaspésie Literacy Council and provides personal information through the application process.

Confidentiality Incidents

Confidentiality incidents occur under the following situations:

When unauthorized access to personal information occurs.
When unauthorized use of personal information occurs.
When unauthorized communication of personal information occurs.
When personal information is lost or if there is a breach in the protection of personal information.

Commission

The Commission is the Commission d’accès à l’information that oversees the application of the Privacy Act and the Access to Information Act.

2. Policy Elements

Patrons of the Gaspésie Literacy Council are natural persons who have the right to have their personal information protected. This policy outlines the Gaspésie Literacy Council’s commitment to protecting personal information while outlining the framework for keeping and destroying said information.

2.1 Objective

The objective of this policy is to comply with the Privacy Act and ensure the Gaspésie Literacy Council’s responsibility in the management of patrons’ personal information while allowing patrons to have better control over the personal information the Gaspésie Literacy Council collects.

This policy defines the roles and responsibilities of the Gaspésie Literacy Council’s leadership, as well as those who collect, access, or otherwise interact with personal information throughout its life cycle at the Gaspésie Literacy Council and provides a process for dealing with complaints regarding the protection of information.

2.2 Scope

All patrons, who are natural persons, who share any amount of personal information with the Gaspésie Literacy Council are protected by the law with which this policy aims to comply. All patrons who access personal information available at the Gaspésie Literacy Council at any point throughout the life cycle of information are bound to respect the elements contained in this policy.

2.3 Roles and Responsibilities

Specific roles and responsibilities are attributed to specific patrons and groups at the Gaspésie Literacy Council, as outlined in the following paragraphs.

2.3.1 Board of Directors

The Board of Directors is responsible for:

Adopting the present policy and ensuring its implementation.
Designating the Privacy Officer, the person who is responsible to oversee the protection of personal information, in writing.
Ensuring appropriate resources are allocated to the Privacy Officer to implement the policy and processes required to protect personal information.

2.3.2 Executive Director

The Executive Director is designated as the Privacy Officer and is responsible for:

Developing this policy and presenting it to the Board of Directors for approval.
Approving practices and procedures to ensure the implementation of this policy.
Preparing an inventory of all personal information held at the Gaspésie Literacy Council, evaluating their level of sensitivity, the purpose for which it was gathered, and who has access to each information.
Conducting Privacy Impact Assessments (PIA) and making recommendations or suggest remedial measures, if required.
Recording, and where necessary reporting, Confidentiality Incidents and implementing measures to prevent their reoccurrence.
Maintaining a registrar of Confidentiality Incidents and sharing it with the Commission when requested.
Informing the Commission when a Confidentiality Incident presents a serious risk of injury or irreparable damage.
Responding to requests to access information or requests to make modifications to personal information.
Receiving and addressing complaints from patrons.
Destroying personal information as per the parameters of this policy.
Ensuring all patrons with any access to personal information sign Confidentiality Agreements.
Developing consent forms and ensuring they are signed.
Training new employees on the application of this policy.
Ensuring privacy information, including the name of the Privacy Officer, are transparently displayed on the Gaspésie Literacy Council’s website.

2.3.3 Employees

Any employee may, in the course of their employment, collect or access personal information. These employees are responsible for:

Knowing, understanding, and respecting the tenets of this policy and all accompanying processes.
Signing a Confidentiality Agreement and adhering to it.
Supporting the Privacy Officer with the inventory of personal information.
Ensuring patrons sign consent forms before any personal information is collected.
Ensuring personal information is kept in a secure location, whether this is a physical or virtual location.
Accessing and using only the personal information which is necessary to do the job.
Informing the Privacy Officer of any Confidentiality Incidents and any violations of the tenets of this policy.
Returning personal information to its secure location after it is consulted.
Referring patrons who wish to submit a formal complaint to the Privacy Officer.

Referring patrons who wish to access or modify their personal information.

2.4 Personal Information at the Gaspésie Literacy Council

Any personal information collected by the Gaspésie Literacy Council is to be used only for the purpose for which it was collected and is kept in a secure location.

2.4.1 Patrons

Patrons may be asked to provide personal information for the purpose of keeping them informed about the Gaspésie Literacy Council’s activities, programs, services, and other campaigns.

When a potential employee or volunteer submits their curriculum vitae to the Gaspésie Literacy Council, they implicitly provide consent to use their personal information to contact them to determine whether or not their candidacy is accepted.

Applicant information may be transferred to employee or volunteer information if the applicant is successful.

2.4.2 Employee and Volunteer Information

Personal information is collected throughout the hiring or onboarding process. Information is contained in each employee’s or volunteer’s secure file and includes sensitive data. Only the Executive Director has access to the Employee and Board volunteer files.

2.4.3 Consent Forms

Consent forms are written in plain language and provide clear and transparent information about the reason for which consent is obtained. All consent forms are kept in a secure location, alongside personal information collected. The purpose for collecting personal information must be serious and legitimate. The reason for collecting this information must be defined before consent is obtained and information gathered. Additionally, the consent form specifies the timeframe for which the consent remains valid.

No person will be denied access to services if they do not consent to providing personal information, unless the information is absolutely necessary for the adequate delivery of the services sought.

2.4.3.1 For Patrons

The purpose of the consent form is to obtain personal information to promote the Gaspésie Literacy Council’s activities, programs, and services. The form also explains the purpose of the information collection and who the information will be shared with.

As an example, the patron’s approximate age is shared with the Ministry of Education, the Gaspésie Literacy Council’s main funder, who requires it.

The consent form asks for patron approval to use pictures and videos taken during Gaspésie Literacy Council activities to advertise activities and programs on the Gaspésie Literacy Council’s website and social media sites. The consent form specifies the length of time the Gaspésie Literacy Council may use these images.

Should patron information be shared with a third party, each patron’s prior informed consent is required.

Personal information may only be used for the purpose identified in the consent form and for the period of time indicated on the consent form. Any deviation from the purpose or timeline must be communicated to the person who signed the consent form, and written approval by the patron of the change of terms must be received.

2.4.3.2 Literacy Assessment

Learners who complete a literacy assessment, or their parent or guardian, must consent to sharing their age, the contents of their assessment, as well as recommendations emanating from the assessment for the sole purpose of supporting their learning.

2.4.3.3 Minors

No personal information about a minor under the age of 14 years may be collected without the consent of a parent or guardian.

Any personal information about minors at the Gaspésie Literacy Council is kept in a secure location, within their parent’s or guardian’s file.

Persons over the age of 14 years may sign their own consent form to authorize the Gaspésie Literacy Council to gather and use their personal information. However, the Gaspésie Literacy Council will request parental consent along with the minor’s consent for those aged between 14 and 18 years of age.

2.4.3.4 For Applicants and Employees

The Gaspésie Literacy Council must inform applicants and employees of the reason for which personal information is collected.

When the Gaspésie Literacy Council seeks to verify references, the applicant must consent. If a third party is hired to validate references, this information must be shared with the applicant so that informed consent is acquired.

When an applicant becomes an employee, the employee can expect that the Gaspésie Literacy Council will keep their personal information in a secure location. The employee may request to access or modify their personal information.

Employees must be informed of any surveillance tools or biometric information used by the Gaspésie Literacy Council to survey or track employees. Biometric information is currently used exclusively to access certain laptops. Changes in the use and collection of biometric information must be communicated to employees, who will have the choice to consent. Consent will be requested from employees. The Gaspésie Literacy Council will create an employee consent form that includes a biometric box.

2.4.4 Rescinding Consent

Any patron may rescind consent at any time. The Gaspésie Literacy Council respects any patron’s desire to rescind consent. A request to rescind consent or to request the destruction of personal information may be made electronically, or in writing.

Those who are on a mailing list must be informed of how they may be removed from such a list. Any donor rescinding consent to receive communications from the Gaspésie Literacy Council must be immediately removed from all mailing lists. All their personal information must be destroyed within the year in which their request is received (see 2.4.7).

2.4.5 Destroying Personal Information

The Privacy Officer is responsible for maintaining an inventory of personal information held at the Gaspésie Literacy Council and updating it at least annually. The inventory may be organized by date of consent to facilitate the destruction of personal information.

When destroying personal information, the Privacy Officer must ensure the information cannot be reconstituted. The Privacy Officer may shred the information or hire a third party to shred the information securely, after completing a PIA (see below).

The Privacy Officer must adhere to the following guidelines for the destruction of personal information:

The personal information of patrons who rescind consent must be destroyed within 30 days of receiving the request.
After seven years, patrons will be contacted to consent to their information being kept for another seven years. If patrons do not consent, information can be anonymized (removal of all identifying information such as date of birth, name, address, etc.) or destroyed (electronic and hard copy versions).
Employee information must be destroyed seven years after the last year of employment.
Applicant files, results of interview questionnaires, and consent to verify references must be destroyed two years after the selection process is completed for applicants who do not become employees or volunteers.
When a patron dies, their personal information must be removed from any active mailing lists and may be anonymized immediately. This takes effect within 30 days of the Gaspésie Literacy Council becoming aware or being notified. The process of anonymization ensures that no identifying information is available in a file, but the data accumulated over the years may serve the Gaspésie Literacy Council for research, analysis, or reporting purposes.

2.4.6 Privacy Impact Assessment

The Privacy Officer must conduct a privacy impact assessment (PIA) before the purchase of any new software, information system or electronic service delivery system from outside of Quebec, involving the collection, use, communication, storage, or destruction of personal information.

The PIA begins with a consultation with the person responsible for the protection of personal information within the company from which the new information system is to be purchased.

The PIA includes:

A description of the project and software.
An evaluation of compliance with the protection of personal information.
An identification and evaluation of the privacy risks.
A description of the measures to attenuate the risks identified.

In the case that a PIA determines that nominal information must be shared and accessed, an agreement between the Gaspésie Literacy Council and the company may be reached. Such an agreement must be sent to the Commission. Contents of the agreement must be in line with article 21.0.2 of the Act. The Gaspésie Literacy Council will add in contracts with third parties that they must respect Quebec Law 25.

2.5 Confidentiality Incidents

A confidentiality incident occurs when personal information is:

Lost or stolen.
Accessed without authorization.
Used for purposes other than those for which it was provided, without prior consent or authorization.
Otherwise impacted and not protected.

The Privacy Officer must identify confidentiality incidents and keep a register of such incidents. The Commission may request a copy of the register at any time.

Each confidentiality incident must be assessed to determine how reoccurrence can be avoided and if it presents a risk of prejudice, of serious injury, or irreparable harm.

The risk of prejudice is assessed by determining:

The level of sensitivity of the information concerned defined by the data collection document, which contains a “sensitivity” column.
The possible consequences of the use of the information concerned.
The likelihood of the information being used in a prejudicial manner.

When a Confidentiality Incident is assessed as a high risk of prejudice, it must be reported to the Commission. When such an incident occurs, the Privacy Officer must also inform the person concerned by the incident.

2.5.1 The Registry of Incidents

The Privacy Officer must keep a registry of incidents and present it to the Commission upon request. The registry of incidents contains:

The date of the incident, including when it was detected and when the parties impacted by the incident were informed.
The circumstances that led to the incident.
The number of people affected.
An evaluation of the level of the risk of prejudice.
Measures taken in response to the incident.

2.6 Process for Complaints

Information about filing a complaint to the Gaspésie Literacy Council’s Privacy Officer will be made available in plain and simple language on the Gaspésie Literacy Council’s website.

To file a complaint with the Gaspésie Literacy Council’s Privacy Officer patrons must send a letter or an email to the Privacy Officer at angelina.leggo@gaspelit.ca and include the following information:

Name and contact details of the complainant.
The date and location of the incident which initiated the complaint.
A detailed description of the incident.
The names of any witnesses or persons involved.
The type of personal information affected by the incident.
The complainant’s signature.

Upon receiving a complaint, the Privacy Officer will:

Acknowledge receipt electronically or in writing within seven business days, or as soon as possible.
Investigate the elements of the complaint diligently or hire a third party to investigate.
Provide a response to the complainant in writing within 30 days of acknowledging receipt.
Inform the complainant of their right to file a complaint with the Commission if the outcome of the investigation does not address their issue.

Should the Commission receive a complaint and prescribe a specific course of action, the Gaspésie Literacy Council must comply within 30 days.

Complaints may be submitted directly to the Commission. The complaint form may be printed or may be completed online at https://plainte.cai.gouv.qc.ca/.

3. Exceptions to the Disclosure of Personal Information

In certain cases where there is reasonable cause to believe a serious risk of death or serious bodily injury (whether physical or psychological) may occur, Gaspésie Literacy Council may choose to disclose personal information of a patron without explicit consent. This information may be disclosed to any person who can come to that patron’s aid. Only necessary information should be communicated for this purpose. The person disclosing this information must make a written entry of the information disclosed, date, who the disclosure was made to and the reason for such emergency disclosure.

No proceedings will be brought against a person disclosing personal information in good faith due to the serious threat of an emergency situation.

4. Consequences

The Commission has the power to impose administrative consequences for any breach to this policy, which is aligned with the law.

The information contained in this policy was published on the Gaspésie Literacy Council’s website on: February 12, 2025