|
.
The Privacy Principles
.
Principle 1 - CRTV's accountability
CRTV is responsible for all personal information under its control, including personal information disclosed to third parties for processing. CRTV has designated a Privacy Act Coordinator as an individual who is accountable for CRTV's compliance with this Code.
1.1 The Privacy Act Coordinator is responsible for CRTV's compliance with this Code even though other individuals within CRTV may be responsible for the day-to-day collection and processing of personal information. Other individuals within CRTV may be delegated to act on behalf of the designated individual.
1.2 The identity of the Privacy Coordinator will be made known internally and will be made available to customers upon request.
1.3 CRTV shall use contractual or other means to protect personal information that has been disclosed to third parties for processing, for example, for billing or marketing purposes.
1.4 CRTV has implemented policies and practices to give effect to this Code, including:
a) implementing procedures to protect personal information;
b) establishing procedures to receive and respond to complaints and inquiries;
c) training staff to understand and adhere to CRTV policies and procedures; and
d) informing staff and customers of CRTV's policy and procedures.
.
Principle 2 - Identifying the purposes for personal information collection
CRTV will identify the purposes for which personal information is collected at or before the time the information is collected.
2.1 CRTV will document the purposes for which they collect personal information as part of their information management policies and procedures. These will include the delivery of cable services, the marketing and delivery of new cable services, as well as non-cable services, and purposes required or permitted by law.
2.2 Depending upon the way in which personal information is collected, the purposes can be specified orally or in writing. An application form, for example, may give written notice of the purposes. The purposes must be stated in such a manner that the customer can reasonably understand how the information will be used or disclosed in order to make consent informed and meaningful.
2.3 When CRTV proposes to use personal information for a purpose not previously identified, such as the marketing of non-cable services, the new purpose shall be identified and documented prior to the new use, as in 2.1. Unless the new purpose is required by law, the consent of the customer or employee is required before the information can be used for that purpose.
2.4 Persons collecting personal information also should be able to clearly explain to customers and employees the purposes for which the information is being collected.
.
Principle 3 - Obtaining consent
CRTV will obtain consent from its customers and employees before or when they collect, use, or disclose personal information, except where inappropriate. CRTV will make reasonable efforts when obtaining consent to ensure that customers and employees understand how personal information will be used and disclosed by CRTV.
3.1 Consent is required for the collection of personal information and the subsequent use or disclosure of this information. In most cases, CRTV will seek consent for the use or disclosure of the information at the time of collection. When CRTV wants to use information for a purpose not previously identified, consent with respect to use or disclosure may be sought after the information has been collected, but before it is used.
3.2 CRTV may collect, use, or disclose personal information without a customer's or employee's knowledge or consent in instances where legal or security reasons, or the welfare of an individual, might make it impossible or impractical to seek consent. For example, when personal information is being collected for the detection or prevention of fraud, seeking consent might defeat the purpose of collecting the information. All of the circumstances where CRTV may collect, use, or disclose personal information without a customer or employee's knowledge or consent is as specified and permitted by legislation.
3.3 CRTV shall ensure that a customer applying for service is made aware of why the company needs the personal information and how the personal information will be used. To make the consent informed and meaningful, the purposes must be stated so that a customer can reasonably understand how the information will be used or disclosed.
3.4 CRTV may not, as a condition of providing service, require a customer to consent to the collection, use or disclosure of personal information beyond that required to provide the service itself.
3.5 Consent can be either express or implied. The form of consent sought by CRTV may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, CRTV shall take into account the sensitivity of the information and the reasonable expectations of the customer. CRTV should generally seek express consent when the information is likely to be considered sensitive. Implied consent is typically appropriate when the information is less sensitive.
3.6 When a customer subscribes to a service and provides personal information and that personal information is for other purposes, the company will:
a) inform the customer that this personal information may be used by an agent of CRTV to market other products and services to the customer;
b) describe the types of agents who might market its products or services; and
c) inform the customer that use of personal information for marketing purposes by its agents is at the option of the customer, and provide a valid opportunity to opt-out of such uses.
3.7 Customers can provide consent in many ways. For example:
a) an application form may be used to seek consent, collect information and inform the customer of the purposes for which the information will be used. By completing and signing the form, the customer is giving express consent to the collection and use of the information for the specified purposes;
b) a check-off box may be used to allow customers to request that their names and addresses not be used or disclosed for secondary or non-related purposes. Customers who do not check the box are assumed to have given implied consent for use of their personal information for the specified purposes;
c) express consent may be given orally when information is collected over the telephone; however a written record should be made of such consent or refusal;
d) consent may be given at the time that customers use a product or service and, in such cases, the decision of an individual to use a product or service may constitute express or implied consent to the collection, use or disclosure of personal information for the specified purposes.
3.8 Customers may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. CRTV shall inform customers of the implications of withdrawing consent.
3.9 Consent to collect and maintain information about employees will normally be obtained at the time of recruitment. Except in circumstances specified and permitted by legislation, other information related to the employee's service with the company will be added to an employee's file with the employee's knowledge.
.
Principle 4 - Limiting the collection of personal information
The collection of personal information by CRTV shall be limited to that which is necessary for the purposes identified by the CRTV. Information shall be collected by fair and lawful means.
4.1 CRTV will collect only the amount and type of personal information needed or specified purposes that have been documented by CRTV and identified to customers and employees. CRTV will specify the type of personal information collected as part of their information management policies and practices.
4.2 CRTV will not mislead or deceive customers or employees about the purposes for which personal information is being collected.
.
Principle 5 - Limiting use, disclosure, and retention of personal information
Personal information shall not be used or disclosed by CRTV for purposes other than those for which it was collected, except with the consent of the customer or employee or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.
5.1 CRTV has developed guidelines, including minimum and maximum retention periods, and implemented procedures with respect to the retention and destruction of personal information. Personal information that has been used to make a decision about a customer or an employee shall be retained long enough to allow the individual access to the information after the decision has been made and to permit any recourse under this Code and applicable privacy legislation.
5.2 CRTV will destroy, erase, or make anonymous personal information that is no longer required to fulfill the identified purposes. CRTV has developed guidelines and implemented procedures to govern the destruction of personal information.
.
Principle 6 - Keeping personal information accurate
CRTV will keep personal information as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used.
6.1 The extent to which personal information shall be accurate, complete, and up-to-date will depend upon how CRTV uses the information, taking into account the interests of the customer or employee. Information shall be sufficiently accurate, complete, and up-to-date so as to minimize the possibility that inappropriate information may be used to make a decision about the customer or employee.
6.2 CRTV will generally keep personal information that is used on an ongoing basis, including information that is disclosed to third parties, accurate and up-to-date.
6.3 CRTV will not routinely update personal information where such updated information is not needed to fulfill the purposes for which it was collected.
.
Principle 7 - Safeguarding personal information
CRTV shall protect personal information with security safeguards appropriate to the sensitivity of the information.
7.1 The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification, regardless of the format in which the information is held.
7.2 The nature of the safeguards will vary depending on the sensitivity of the information that has been collected, the extent of the information, and the method of storage. A higher level of protection should safeguard more sensitive information.
7.3 The methods of protection should include:
a) physical measures, for example, locked filing cabinets and restricted access to offices;
b) organizational measures, for example, security clearances and limiting access on a "need to know" basis;
c) technological measures, for example, the use of passwords and encryption; and
d) investigative measures where required to safeguard the interests of the CRTV, its customers or its employees.
7.4 CRTV shall make its employees aware of the importance of maintaining the confidentiality of personal information.
7.5 CRTV shall dispose of personal information in a manner that prevents unauthorized parties from gaining access to the information.
.
Principle 8 - Being open about policies and procedures
CRTV shall make readily available to customers and employees specific information about its policies and procedures relating to the management of personal information.
8.1 CRTV will be open about its policies and procedures with respect to the management of personal information. Customers and employees shall be able to acquire information about CRTV's policies and procedures at minimal cost and without unreasonable effort. This information shall be made available in a form that is generally understandable.
8.2 The information made available by CRTV shall include:
a) the Privacy Coordinator who is accountable for CRTV's policies and procedures and to whom complaints or inquiries can be forwarded;
b) the means of gaining access to personal information held by CRTV;
c) a description of the type of personal information held by CRTV, including a general account of its use;
d) a copy of any documents that describe CRTV's policies, standards, and/or codes; and
e) a description of personal information made available to related organizations, or agents.
.
Principle 9 - Providing access to personal information
Upon request, and unless prohibited by law, CRTV shall inform customers and employees of the existence, use, and disclosure of their personal information and provide access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
9.1 Upon request, CRTV shall inform a customer or employee whether or not the company holds personal information about them, and should indicate the source of this information. If CRTV possesses such information, it will allow the customer or employee access to this information. In addition, CRTV shall provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed.
9.2 CRTV may require a customer or employee to provide sufficient information to permit the company to provide an account of the existence, use, and disclosure of personal information. The information provided shall only be used for this purpose.
9.3 In certain situations, CRTV may not be able to provide access to all the personal information it holds. Exceptions to the access requirement must be limited to those allowed or required under law.
9.4 In providing an account of third parties to which it has disclosed personal information, CRTV will attempt to be as specific as possible. When it is not possible to provide a list of the actual organizations to which it has disclosed information, CRTV shall provide a list of organizations to which it may have disclosed information.
9.5 CRTV shall respond to a customer or employee request within a reasonable time and at minimal or no cost. The requested information shall be provided or made available in a form that is generally understandable. If CRTV uses abbreviations or codes to record information, an explanation shall be provided.
9.6 When a customer or employee successfully challenges the accuracy or completeness of personal information, CRTV shall correct, delete, or add information as required. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question.
9.7 When a challenge is not resolved to the satisfaction of the customer or employee, CRTV shall record the substance of the unresolved challenge in the personal information relating to the customer or employee. Where appropriate, the existence of the unresolved challenge shall be transmitted to third parties having access to the information in question.
.
Principle 10 - Challenging compliance
CRTV customer or employee shall be able to address a challenge concerning compliance with the above principles to the Privacy Coordinator.
10.1 CRTV shall put procedures in place to receive and respond to complaints or inquiries about its policies and procedures relating to the handling of personal information. The complaint process should be easily accessible and simple to use.
10.2 CRTV shall investigate all complaints. If a complaint is found to be justified, CRTV shall take appropriate measures, including amending its policies and procedures if necessary.
10.3 CRTV shall inform customers who lodge complaints, or inquire about complaint procedures, that they can contact the Cable Television Standards Council (CTSC) if they are not satisfied with the response from the CRTV. In the event the CTSC is not able to resolve the issue, the customer can bring the matter to the attention of the Office of the Privacy Commissioner.
10.4 Employees also have recourse to the Office of the Privacy Commissioner if they consider CRTV has not responded satisfactorily to their complaint or inquiry.
To contact the Cable Television Standards Council
Cable Television Standards Council
1910 - 350 Albert Street
Ottawa, Ontario
K1R 1A4
Tel: (613) 230-5442
Toll-free 1-800-426-4170
Fax: (613) 230-5679
Email: comments@ctsc.ca
Web site: http://ctsc.ca/
(contains an online complaints form)
To contact the Office of the Privacy Commissioner of Canada
Privacy Commissioner of Canada
112 Kent Street
Ottawa, Ontario
K1A 1H3
Phone (613) 995-8210
Toll-free 1-800-282-1376
Fax (613) 947-6850
E-mail: info@privcom.gc.ca
(complaints must be submitted in writing)
Web site: http://www.privcom.gc.ca/
|
HISTORY
