Halifax Regional Water Commission (HRWC) is committed to respecting the privacy rights of all individuals whose personal information it has collected and to ensuring the confidentiality and security of that personal information and to excellence in the management of that personal information.
HRWC will ensure adherence to the privacy protection provisions of Part XX (Freedom of Information & Protection of Privacy) of the Municipal Government Act (MGA), the Personal Information International Disclosure Protection Act (PIIDPA) and other applicable legislation.
Violations of this policy whether intentional or inadvertent, may result in disciplinary action up to and including termination of employment. Where appropriate, legal sanctions may be pursued.
Employee - includes a person retained under an employment contract to perform services for HRWC. For the purpose of this policy, an employee also includes individuals seconded to HRWC and volunteers, students and interns who have access to records
FOIPOP - Freedom of Information and Protection of Privacy, Part XX of the MGA
Personal Information - as defined in Part XX of the MGA, is recorded information about an identifiable individual including:
- The individual's name, address or telephone number;
- The individual's age, sex, sexual orientation, marital status or family status;
- The individual's race, national or ethnic origin, colour, or religious or political beliefs or associations;
- An identifying number, symbol or other particular assigned to the individual;
- The individual's fingerprints, blood type or inheritable characteristics;
- Information about the individual's health-care history, including a physical or mental disability;
- Information about the individual's educational, financial, criminal or employment history;
- Anyone else's opinions about the individual, and
- The individual's personal views or opinions, except if they are about someone else.
PIB - Personal Information Bank is a collection of paper records or electronic documents that are sorted by a personal identifier such as name, employee number or a database that is indexed by one or more personal identifiers.
PIIDPA - Personal Information International Disclosure Protection Act
Privacy Breach - an event of unauthorized collection, access, use, disclosure, storage or alteration of personal information.
Record - as defined in Part XX of the MGA, includes books, documents, maps, drawings, photographs, letters, vouchers, papers and any other thing on which information is recorded or stored by graphic, electronic, mechanical or other means, but does not include a computer program or any other mechanism that produces records.
The objectives of this policy are:
- To ensure HRWC meets its legislated and regulatory responsibilities in the management of personal information;
- To ensure consistency in practices and procedures in administering such legislated and regulatory responsibilities;
- To ensure effective protection and management of personal information by identifying, assessing, monitoring and mitigating privacy risks in HRWC programs and activities involving the collection, retention, use, disclosure, storage and disposition of personal information;
- To ensure only the minimum amount of personal information required for a specific purpose is collected, used or retained; and
- To ensure that appropriate consent is obtained and that systems used for storing personal data comply with legal and regulatory requirements.
- HRWC will collect, access, store, use, and disclose personal information only where authorized by law or agreement.
- HRWC will make reasonable efforts to ensure that individuals understand the purpose for which their personal information is being collected and the need for such collection.
- HRWC will limit its collection of personal information to that which is required for its programs and services; reasons for collection of information will be provided at the time that consent is sought. Where an Act, Regulation or Municipal By-law requires that information be provided, consent will not be required for the collection of that information.
- HRWC will use and disclose an individual’s personal information only for the purpose for which it was collected, for a use consistent with that purpose, for other purposes for which consent has been obtained, or for other purposes required or permitted by law.
- HRWC is committed to protecting personal information through appropriate administrative, technical and physical security measures and safeguards, regardless of the format in which the personal information is held.
- HRWC will retain personal information in accordance with legislative requirements and will ensure that proper care is taken in the disposal of personal information.
- HRWC will make every reasonable effort to ensure its records of an individual’s personal information are accurate and complete and will allow a person access to their own information to verify, update and correct it.
- HRWC will ensure that this policy is considered for all new and significantly amended programs or services that collect, use or disclose personal information.
- HRWC will establish a privacy breach/complaint protocol as per Appendix A.
Complaints or questions with respect to this policy may be directed to the Corporate Legal Counsel for Halifax Water.
Employees – All HRWC employees are required to know and understand their obligations under this policy. Employees are expected to respect the confidentiality of personal information and report any breaches of privacy to their immediate supervisor. Employees will make reasonable efforts to ensure personal information is protected.
Supervisors and Managers – along with the responsibilities noted above, Managers and Supervisors are required to ensure that their staff follow this policy and the applicable Acts.
Directors - along with responsibilities noted above, Directors are responsible for making reasonable security arrangements for personal information in their custody, ensuring that staff receive privacy awareness training, and ensuring that service providers are compliant with this policy.
General Manager – will provide advice and guidance to Elected Officials, Executive & Senior Management and employees with respect to the treatment of personal information within HRWC and will monitor and report on HRWC’s compliance with this policy. In addition, the General Manager is responsible for the proper application of Part XX of the MGA, PIIDPA and other Acts or policies with respect to personal information.
The General Manager will be responsible for monitoring compliance with this policy and conducting an annual review of this policy.