Privacy
Statement | Privacy
Policy | Opt
- In/Out Form
YMCA
of Simcoe/Muskoka Privacy Policy
Introduction
The federal and provincial governments have passed
legislation that require charities and not-for-profit
organizations to have in place by January 1, 2004
a privacy policy and public statement, plus a framework
for practices to implement the policy and monitoring
to ensure compliance.
The following has been approved by the Board of Directors
as our Association’s privacy policy and public
statement, plus a set of principles and procedures
to guide how we implement the policy in practice.
Privacy Policy and Public Statement
for YMCA Staff and Volunteers
The following Privacy Policy and Public Statement
is to be included in our Association Policies and
Practices Manual and published in our communication
materials and on our website.
“The YMCA strives to ensure that volunteers
and staff conduct their relationships with each other,
participants and all other Association contacts with
integrity, good judgement and fairness. The YMCA respects
the right of individuals to the protection of their
personal information. The YMCA is committed to maintaining
the confidentiality, privacy, and accuracy of personal
information it collects, uses and discloses about
its participants, members, donors, parents/guardians,
staff and volunteers.”
Required Reading
Protecting the Privacy of Personal
Information:
Personal
information is information about an identifiable
individual.
- Examples
of personal information include, but are not limited
to, name, address, gender, age, ID numbers, income,
racial or ethnic origin, relationship status, employee
files, payment or medical/health records, assessments
or evaluations.
- An
individual’s name does not need to be attached
to the information in order for it to qualify as
personal information.
-
Personal information does not include name, title,
business address, or business phone number of an
employee of an organization.
AVAILABLE RESOURCES
The following Web sites provide useful information
on privacy:
Privacy
Protection Procedure:
All
staff and volunteers must…
Protect personal information by following responsible
information handling practices, in keeping with privacy
laws. See Required Reading Protecting the Privacy
of Personal Information. YMCA staff and volunteers
having access to personal information must follow
the ten fair information principles and steps for
implementing these principles, in keeping with privacy
laws.
PRINCIPLE
1 - ACCOUNTABILITY
Policy - The YMCA is responsible
for personal information under its control and shall
designate an individual or individuals who are accountable
for YMCA compliance with established privacy principles.
Procedures - Vice-Presidents, General
Managers and Directors are responsible for and shall
oversee compliance by their staff with the YMCA privacy
protection procedure and fair information principles,
to ensure:
a) Purposes are defined for collection of personal
information;
b)
Consents are obtained;
c) Collection, use and disclosure of personal information
is limited;
d) Information used is accurate, complete and up-to-date;
e) Adequate safeguards protect personal information
in the YMCA’s control;
f) Retention and destruction timetables are maintained;
g) Access requests by individuals are processed
promptly;
h) Timely response is provided to an inquiry or
complaint regarding YMCA handling of personal information.
i)
Contracts with third parties that process YMCA information
shall include privacy protection requirements.
Supervisors are responsible for the day-to-day collection,
processing and safeguarding of personal information
under their control. Supervisors shall inform and
train staff, and volunteers having access to personal
information.
Staff
and relevant volunteers shall follow the privacy protection
practices established by the YMCA when collecting,
using, disclosing and safeguarding personal information.
Upon request by an individual, staff and volunteers
shall make known contact information for the Vice-Presidents,
General Managers or Directors, to whom inquiries or
complaints can be forwarded about our YMCA privacy
protection procedure and practices.
PRINCIPLE
2 - IDENTIFYING PURPOSES
Policy
- The YMCA shall identify the purposes for
collecting personal information before or at the time
personal information is collected.
Procedures
- The YMCA needs to collect, use and disclose
some information about its participants, members,
donors, parents/guardians, staff and volunteers, in
order to conduct its operations, and deliver YMCA
programs and services to the communities it serves.
The YMCA’s purposes for collecting personal
information are:
a) To establish and maintain responsible relationships
with its participants, members, donors, parents/guardians,
staff and volunteers;
b) To manage, develop and enhance YMCA operations,
programs and services;
c) To acknowledge gifts, issue tax receipts, and
other administrative requirements including information
requests;
d) To process and collect fees for service;
e) To assess participant needs;
f) To determine program, service, employment or
volunteer eligibility;
g) To provide safe and secure YMCA environments;
h)
To collect data for statistical purposes;
i) To better understand the changing needs of communities
we serve;
j) To communicate a range of programs, services,
and philanthropic opportunities that benefit people
we serve;
k) To meet legal, regulatory and contractual requirements.
The YMCA shall indicate either verbally, electronically
or in writing, at or before the time personal information
is collected, the purpose for which it is being collected.
Staff
and volunteers collecting personal information shall
use reasonable efforts to explain identified purposes,
or refer the individual to a supervisor who shall
explain the identified purposes for collecting personal
information.
Unless
required by law, staff and volunteers shall not use
or disclose for any new purpose personal information
that has been collected, without the consent of the
individual. Staff shall advise their Vice-President,
General Manager or Director of a potential new identified
purpose. Any new identified purpose must be approved
by the CEO, documented and consent obtained from individuals
prior to YMCA use or disclosure.
PRINCIPLE
3 - CONSENT
Policy
- The knowledge and consent of an individual
is required for the collection, use, or disclosure
of personal information, except where not required
by law.
Procedures
- In obtaining consent, staff and volunteers
shall advise participants, members, donors, parents,
staff and volunteers of identified purposes for which
personal information will be used or disclosed. Purposes
shall be communicated in clear, understandable language.
For
children under 12 years of age, the YMCA will obtain
permission from a parent or legal guardian to collect
and use personally identifiable information about
a child.
The YMCA obtains consents and permission slips for
children and youth to participate in a number of YMCA
programs and services. For more information on consents
in your program or service area, please speak with
your supervisor or Director or General Manager.
The YMCA takes into account the sensitivity of the
personal information when determining what form of
consent is appropriate for the circumstances.
In
general, the following actions by an individual constitute
implied consent for the YMCA to collect,
use and disclose personal information for purposes
identified to the individual:
a) registration for YMCA programs and services;
b) completion of a donation pledge form;
c) acceptance of employment and benefits enrollment
by an employee;
d) acceptance of a volunteer position or student
placement.
For most YMCA employment and community service programs,
the YMCA is obligated by its contract with the government
to obtain the express written consent from
a participant to collect, use and disclose their personal
information.
Express
consent is required from an individual when dealing
with more sensitive information, such as personal
financial and medical data. Speak with your supervisor
for more information about when express consent is
required in your program or service area.
Individuals
may at any time withdraw their consent to the YMCA’s
use or disclosure of their personal information, subject
to certain service, legal or contractual restrictions.
Individuals
wishing to withdraw consent may contact the YMCA for
more information regarding the implications of withdrawing
consent. Our YMCA Opt-out
and Reverse Opt-out form is available online,
or by contacting our YMCA Association Offices.
Exceptions
The YMCA may collect, use or disclose information
without an individual’s prior knowledge or consent
in certain circumstances permitted by law.
For
example, the YMCA may collect, use or disclose personal
information without prior knowledge or consent, if
it is clearly in the best interest of the individual
to do so, such as in an emergency situation where
the life, health or security of an individual is threatened.
YMCA
may disclose personal information without prior knowledge
or consent of the individual:
a) to a lawyer or other legal representative of
the YMCA;
b) to a government body or agency in certain circumstances;
c) to collect a debt, or comply with a subpoena,
warrant or other court order,
or as may be otherwise required by law;
d) in circumstances otherwise permitted by law.
For more information about consent and disclosure,
please speak with your Director, General Manager or
Vice-President.
PRINCIPLE 4 - LIMITING COLLECTION
Policy
- The
YMCA shall limit the collection of personal information
to that which is necessary for the purposes identified
by the YMCA. Information shall be collected by fair
and lawful means.
Procedures
- When collecting personal information, staff
and volunteers will usually collect it directly from
the individuals about whom the personal information
pertains.
Personal
information may be collected from other sources with
prior consent from the individual, for example, from
prior employers, personal references or from other
third parties having the right to disclose the information.
To avoid the complications of privacy laws, the YMCA
will consider using whenever possible non-identifiable
information, such as coded or anonymous data, that
does not identify individuals.
PRINCIPLE 5 - LIMITING USE, DISCLOSURE, AND RETENTION
Policy - The YMCA shall not use or
disclose personal information for purposes other than
those for which it was collected, except with the
consent of the individual or as required by law. Personal
information shall be retained only as long as necessary
for the fulfilment of those purposes.
Procedures
- In certain circumstances personal information can
be collected, used or disclosed without the knowledge
and consent of the individual. See Exceptions above
under Principle 3 - Consent.
Personal
information shall be retained only as long as necessary
for the fulfilment of those purposes for which it
was collected, or as required by law, or by contract
with a funding partner.
Depending
on the circumstances, where personal information has
been used to make a decision about an individual,
the YMCA shall retain, for a period of time that is
reasonably sufficient to allow for access by the individual,
either to actual information or the rationale for
making the decision.
Supervisors
shall maintain schedules for records retention and
destruction, which apply to personal information that
is no longer necessary or relevant for the identified
purposes for collection, or required to be retained
by law or under contract. Such information shall be
destroyed, erased or rendered anonymous.
Speak
with your Director, General Manager or Vice-President
for more information on records retention and destruction
requirements for your program or service area.
PRINCIPLE
6 - ACCURACY
Policy - Personal information shall
be as accurate, complete and up-to-date as is necessary
for the purposes for which it is to be used.
Procedures - Personal information
used by the YMCA shall be sufficiently accurate, complete
and up-to-date to minimize the possibility that inaccurate
information is being used to make a decision about
an individual.
If
staff and volunteers are aware of any inaccuracy or
changes in their personal information that the YMCA
holds about them, please contact the appropriate supervisor
to make corrections.
Staff handling personal information shall update personal
information about participants, members, donors, parents/guardians,
staff and volunteers, as and when necessary.
Speak
with your supervisor or Director, General Manager
or Vice-President if you have questions about correction
requests or on how accurate, complete and up-to-date
personal information needs to be.
PRINCIPLE
7 - SAFEGUARDS
Policy - The YMCA shall protect personal
information by security safeguards appropriate to
the sensitivity of the information.
Procedures - All staff and volunteers
with access to information shall be required as a
condition of employment or volunteer role, to respect
the confidentiality of personal information.
The more sensitive personal information is, the more
security is required. Speak with your supervisor for
more information on safeguards appropriate to the
sensitivity of personal information in your program
or service area.
Staff shall protect personal information in their
control (regardless of format) against such risks
as loss or theft, unauthorized access, disclosure,
copying, use, modification or destruction, through
appropriate security safeguards.
Safeguards
may include physical measures (such as locked doors,
locked file cabinets), organizational measures (such
as staff training, limited access, security clearances)
and technological measures (such as passwords, anti-virus
software for computer systems).
Personal
information shared with a third party for processing
shall be protected through contractual agreements
with requirements for confidentiality and appropriate
safeguards.
PRINCIPLE
8 - OPENNESS
Policy - The YMCA shall make readily
available to individuals, information about its procedures
and practices relating to the management of personal
information.
Procedures
- Information on the YMCA’s commitment to privacy
is available to the public on the YMCA’s web
site at www.ymcaofsimcoemuskoka.ca or by contacting
the YMCA Association Offices.
Staff
and volunteers shall make known upon request the contact
information for the General Managers or Directors
to whom inquiries or complaints can be forwarded.
See below Principle 10 - Challenging Compliance.
PRINCIPLE
9 - INDIVIDUAL ACCESS
Policy - The YMCA shall upon request
inform an individual of the existence, use and disclosure
of his or her personal information and shall give
the individual access to that information. An individual
shall be able to challenge the accuracy and completeness
of the information and have it amended as appropriate.
Procedures - Staff and volunteers
shall refer requests about personal information held
about an individual to their supervisor or Director,
General Manager or Vice-President.
Staff
shall immediately inform their supervisor or Director,
General Manager or Vice-President of a request for
access by an individual to his or her personal information
collected by the YMCA. A Director, General Manager
or Vice-President shall respond to a written request
for individual access by providing access to the individual’s
data, except in limited circumstances. See Exceptions
to Access below.
In
order to safeguard personal information, an individual
may be required to provide sufficient identification
information to permit YMCA to account for the existence,
use and disclosure of personal information, and authorize
access to the individual’s file.
A Director, General Manager or Vice-President shall
respond to a written request for access in a reasonable
time, and at minimal or no cost. Personal information
shall be provided in a format that is understandable,
along with any explanation needed to facilitate the
individual's understanding.
A
Director, General Manager or Vice-President or designate
shall provide the individual a reasonable opportunity
to review and challenge the accuracy and completeness
of personal information. A statement of disagreement
will be attached to records where a requested amendment
cannot be made.
Upon
request, a Director, General Manager or Vice-President
shall provide an account of the use and disclosure
of personal information. A list of organizations to
which the YMCA may have disclosed personal information
shall be provided, when it is not possible to provide
a list of actual disclosures.
Staff can request access to their employee file by
contacting their Director, General Manager or Vice-President
who will in turn access their file from the Human
Resources department.
Exceptions to access
The YMCA may not be able to provide an individual
with access to some or all of his or her personal
information in certain circumstances permitted by
law. Some exceptions include if:
a) doing so would likely reveal personal information
about a third party;
b)
disclosure could reasonably be expected to threaten
the life or security of another individual;
c)
information was collected in relation to the investigation
of a breach of an agreement, or a contravention
of law, or as otherwise permitted by law.
If access to personal information cannot be provided,
a Director, General Manager or Vice-President shall
provide the individual with written reasons for denying
access.
PRINCIPLE
10 - CHALLENGING COMPLIANCE
Policy - An individual shall be able to address a
challenge concerning compliance with the above principles
to the designated persons accountable for YMCA compliance.
Procedures - Staff and volunteers shall refer any
inquiries or complaints about the YMCA’s handling
of personal information, to a Director, General Manager
or Vice-President for response in a fair and timely
manner.
Individuals
may contact a Director, General Manager or Vice-President
to discuss their question about YMCA information handling
practices, or may contact the YMCA Association Offices
at:
Telephone: (705) 726-YMCA (9622)
Fax: (705) 792-7874
Email: privacy@ymcaofsimcoemuskoka.ca
Staff
should encourage individuals with a complaint or concern
to talk to the Director, General Manager or Vice-President
for their YMCA service area. In most cases, talking
with senior staff will resolve a complaint.
If
the problem is not resolved to the individual’s
satisfaction, the individual may contact the YMCA
Association Offices. The individual will be asked
to provide the following information in writing:
-
Name, address or fax number where the individual
prefers to be reached;
-
Nature of the complaint, relevant details, what
the individual would like us to do;
-
Name of YMCA staff with whom the individual has
already discussed the issue.
YMCA Association Offices will immediately forward
a privacy complaint to the attention of a Vice-President.
The respective Vice-President will work with our Privacy
Officer to investigate privacy complaints. If a complaint
is found to be justified, the YMCA shall take appropriate
measures to resolve the complaint.
ONGOING RELEVANCY
The YMCA regularly reviews its policies and procedures
to ensure we remain current with changing laws and
evolving public expectations.
The
YMCA is committed to protecting personal information
by following responsible information handling practices
in keeping with privacy laws.
If
you have questions about our privacy statement, please
email privacy@ymcaofsimcoemuskoka.ca
|
