7.0 PRIVACY OF INFORMATION POLICIES
Privacy of Information
Policy Group: Privacy of Information Policies Policy Number: 7.0-01
Date Approved: August 18, 2015
Date Revised/Reviewed: July 24, 2019; September 16, 2020, October 13, 2021; October 12, 2022
INTENT: To protect the personal privacy and trust placed by Habitat for Humanity Northumberland’s (HFHN) members, volunteers, partner families, homeowners, clients, directors, officers, and staff in the organization. HFHN’s privacy policy is prepared in accordance with applicable provincial and federal legislation and standards.
POLICY
Disclaimer: The word ‘supporter’ will be used from herein in reference to prospective, current and past members of homeowner families, members of partner families, any other client HFHN interacts with, volunteers, directors, officers, members, employees, financial supporters and any individual who has been in a contributory relationship with HFHN.
Collection of Personal Information
HFHN is committed to identifying the purpose for which personal information is collected at or before the time the information is collected and to documenting the purposes for which personal information is collected. HFHN generally collects necessary personal information in order to administer HFHN programs and services. It is expected that every employee and volunteer who has access to personal information will be familiar with the policy and will commit to protecting the privacy of personal information from all sources.
HFHN may:
a) Collect banking and credit card information to receive and process donations or for pre-authorized credit or debit transactions. In addition, HFHN may collect contact information to acknowledge donations and issue tax receipts. HFHN may also contact the supporter to inform them of and to request their support for our future endeavors because the supporter has demonstrated an interest in supporting HFHN’s mission, unless the supporter has indicated differently;
b) Collect applicant information (such as names and ages of family members, current address, work history, income, assets, debt, credit history, housing requirements (i.e. accessibility), and condition and size of current dwelling to determine if a family qualifies for any HFHN programs or services, including services HFHN is delivering on behalf of a third party (i.e. Northumberland Renovates). The applicant information for the Homeownership and Home Repair programs assesses credit-worthiness, need, stability of relationships, steady income, willingness and ability to partner with HFHN. For the Home Repair programs HFHN will also collect information on title registration for the property in need of repair;
c) Collect mortgage application information to grant mortgage funds, ReNew It loans, or Habitat Maintains grants, collect mortgage payments and property taxes, collect ReNew It payments, transfer ownership to the family, engage professional mortgage administration and confirm payment of current property insurance;
d) Collect family and neighborhood statistics and testimonials to raise awareness of and increase potential fundraising, new family applicants, and gain relevant information related to HFHN’s activities;
e) Collect personal information from past, present and prospective volunteers, employees and members for administrative or management purposes (i.e. to establish, manage or terminate a volunteer, employment or member relationship); and
f) Through written request to HFHN’s Privacy Officer from a supporter, disclose information concerning the collection, the use which will be made of the information, the categories of person who will have access to it within the organization, the place where the file will be kept and the supporter’s rights of access and rectification, where appropriate consents are obtained and adherence to legislative requirements is met.
In addition, HFHN will NOT:
a) Collect personal information indiscriminately. Both the amount and the type of information collected is limited to that which is necessary to fulfill the general purposes outlined above; and
b)Use previously collected personal information for a new purpose without first identifying the new purpose and obtaining the supporter’s consent for the new use, unless otherwise permitted by law.
Obtaining Consent
HFHN is committed to obtaining the supporter’s consent for the collection of personal information and the subsequent use or disclosure of this information, unless otherwise permitted by law. Additionally:
-
In obtaining consent, HFHN will make a reasonable effort to ensure the supporter is advised, in a manner that can be reasonably understood, of the purposes for which the information will be used and how the information is handled;
-
Generally, by providing us with personal information, HFHN will assume that the supporter consents to HFHN’s collection, use and disclosure of such information for the purposes described in this policy or otherwise at the time of collection;
-
If a supporter is providing HFHN with personal information about another individual, HFHN will request proof that the supporter has consent from that person to provide their personal information to HFHN;
-
HFHN will not, as a condition of supplying a product or service, require the supporter to consent to the collection, use or disclosure of personal information beyond that required to provide the product or service;
-
HFHN collects personal information through fair and lawful means, and not through false or misleading practices; and
-
In determining the appropriate form of consent, HFHN will take into account the sensitivity of the personal information and the supporter’s reasonable expectations.
The supporter may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting the Privacy Officer in writing. Please note that the withdrawal of consent may impact HFHN’s ability to serve the supporter and maintain the relationship.
This policy must be used in conjunction specifically with Policy 5.0-05 Social Media and Email Blasts regarding electronic communication with supporters and obtaining consent for this type of communication.
Note: In certain circumstances personal information can be collected, used, or disclosed without the supporter’s knowledge and consent. For example, legal, medical or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking consent might defeat the purpose of collecting information. Seeking consent may be impossible or inappropriate if the supporter were a minor, seriously ill, or mentally incapacitated.
Finally, HFHN may collect information without consent if collection is reasonable for the purposes of establishing, managing, or terminating an employment or volunteer relationship, and HFHN is not legally prevented from doing so.
Use and Disclosure of Personal Information
HFHN does not use or disclose personal information for purposes other than those which it was originally collected, except with consent or as otherwise permitted by law.
HFHN remains responsible for personal information in its possession or custody, including information that is transferred to a third party for processing. As such, HFHN enters into confidentiality or contractual agreements with third parties which are engaged to perform services on its behalf and to whom HFHN transfers personal information for processing, requiring them to provide a level of security comparable to that provided under this policy.
Protection of Personal Information
HFHN is committed to protecting personal information by security safeguards appropriate to the sensitivity of the information:
a) HFHN protects personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which it is held;
b) HFHN protects personal information with physical security measures, such as locked filing cabinets and restricted access to areas where personal information is stored. This is managed and monitored through the Document and Inventory Control Plan referred to in Policy 2.0-02 Document Inventory and Control;
c) HFHN protects personal information with organizational security measures, such as security clearances and limiting access to a “need-to-know” basis. In addition to ensuring that employees and volunteers are aware of the importance of maintaining the confidentiality of personal information, HFHN also enters into confidentiality or contractual agreements with third parties to whom HFHN provides personal information;
d) HFHN uses technological security measures, including passwords and encryption, to prevent unauthorized access to personal information stored on its computer systems; and
e) When disposing of or destroying personal information which is no longer needed, HFHN ensures that appropriate measures are taken regarding the disposal or destruction so as to prevent unauthorized parties from gaining access to the personal information.
Retention of Personal Information
HFHN is committed to retaining personal information only as long as necessary for the fulfillment of the general purposes outlined above or for the fulfillment of legal or business purposes:
a) HFHN will retain personal information that has been used to make a decision about the supporter for at least one year, even if retention is no longer necessary because the identified purpose for which the personal information was collected is no longer being served, to allow the supporter access to the information after the decision has been made; and
b) HFHN will retain personal information that is the subject of a request for as long as is necessary to allow the supporter to exhaust any recourse they may have under federal and provincial legislation across Canada, even if retention is no longer necessary because the identified purpose for which the personal information was collected is no longer being served.
Access to Personal Information
HFHN may establish and maintain a file of a supporters’ personal information for the purposes described above, which will be accessible at the address listed below. Upon receipt of a written request, HFHN will inform the supporter of the existence, use and disclosure of their own personal information and will provide access to that information. The supporter will be able to challenge the accuracy and completeness of the information and have it amended as appropriate:
a) Upon receipt of a written request, HFHN will provide an account of the use that has been made or is being made of the personal information and an account of the third parties to which it has been disclosed. When it is not possible to provide a list of the third parties to which HFHN has actually disclosed the personal information, HFHN will provide a list of organizations to which HFHN may have disclosed the personal information;
b) In responding to a written request, HFHN may require the supporter to provide sufficient information to permit HFHN to verify identification before HFHN provides an account of the existence, use and disclosure of personal information. Supporters may forward a request in writing to the Privacy Officer at the address set out herein;
c) If assistance is required in preparing a written request, HFHN will refer the supporter to an appropriate individual to provide that assistance in accordance with the Policy 8.0-04: Customer Service Policy;
d) Within 30 days after receipt of a written request, HFHN will either respond to the supporter’s query or send the supporter a notice of extension, advising them of the new time limit, the reasons for extending the time limit and the supporter’s right to make a complaint to the Commissioner. HFHN may extend the time limit for a maximum of 30 days if meeting the time limit would unreasonably interfere with HFHN’s activities or is impracticable because HFHN needs to undertake consultations necessary to respond to the supporter’s request. Or, HFHN may extend the time limit for whatever period is necessary to convert the personal information into an alternative format;
e) HFHN will respond to a written request at no or minimal cost to the supporter. If there is a cost involved for the transcription, reproduction or transmission of personal information, HFHN will inform the requesting supporter of the approximate cost beforehand and will only proceed if the supporter makes the payment in advance;
f) The requested information will be provided or made available in a form that is generally understandable. For example, if HFHN uses abbreviations or codes to record information, an explanation of such abbreviations or codes will be provided;
g) In certain situations, HFHN may not be able to provide access to all the personal information held in reference to the supporter. Exceptions may include information that is prohibitively costly to provide, that contains references to other individuals, that cannot be disclosed for legal, security or commercial proprietary reasons, and that is subject to any category of privilege. However, if the information containing the exceptions is severable, HFHN will sever the information and provide the requesting supporter with access to the remaining information; and
h) The reasons for denying access and the statutory provision on which the refusal is based will be provided to the supporter in writing, along with any recourse that they may have under federal and provincial legislation across Canada.
Correction of Personal Information
HFHN is committed to maintaining as accurate, complete and up-to-date personal information as is necessary for the purposes for which it is to be used and to minimize the possibility that inappropriate information may be used to make a decision about the supporter:
a) HFHN does not routinely update personal information unless such a process is necessary to fulfill the purposes for which the information was collected or HFHN receives notification from the supporter to do so. If the supporter is aware of changes to the personal information they have given, they may write the Privacy Officer and HFHN will update our records accordingly;
b) When the accuracy or completeness of personal information is successfully challenged, HFHN will amend the personal information as required and issue a copy of any personal information modified or added or an attestation that personal information has been deleted. Where appropriate, the amended information will be transmitted to third parties having access to the information in question; and
c) Any unresolved challenges will be recorded in the supporter’s file. Where appropriate, the existence of the unresolved challenge will be transmitted to third parties having access to the information in question.
Compliance
In meeting the privacy responsibilities, HFHN will act in a reasonable manner as required by the circumstances:
a)The Secretary of the Board of Directors has been designated as the Privacy Officer. The Privacy Officer can be reached by regular mail at:
ATTENTION: Privacy Officer
HABITAT FOR HUMANITY NORTHUMBERLAND
764 Division St. Cobourg, ON K9A 5V2
Or by e-mail at:info@habitatnorthumberland.ca;
b)A challenge concerning compliance with privacy laws can be addressed to the Privacy Officer;
c)HFHN will investigate all complaints. If a complaint is found to be justified, then HFHN will take appropriate measures to resolve the matter including, if necessary, amending appropriate policies and practices; and
d)HFHN reserves the right to seek legal advice where appropriate before providing a final response to inquiries or complaints.
Internet Usage
When anyone visits HFHN’s website at habitatnorthumberland.ca to obtain information, to research HFHN’s products and services, or to use HFHN’s online tools, HFHN does not collect identifying information unless it is specifically provided. The only information collected is non-identifying information (such as the ISP, the type of internet browser used, the referring website, the pages requested and the date and time of those requests) to create aggregate data in order to determine the level of interest in the information provided on the website and to improve the content of the website.
HFHN collects this non-identifying information through the use of cookies and server log files, including IP addresses. The website does not link IP addresses to any personally identifiable information. Cookies identify which areas of the website someone has visited or customized, and makes these pages readily accessible next time the website is visited. If it is preferred that this non-identifying information not be collected through the use of cookies, it can be disabled by changing the internet browser settings.
In addition, HFHN may provide links to other websites managed by third parties or permit third parties to offer subscriptions and registration-based service through its website. As HFHN cannot control or be responsible for the actions or policies of such third parties, it is advisable to check the applicable privacy policy of such third parties when visiting their websites or when providing any personal information to them. Please also note that HFHN cannot control or prevent the use of cookies or any information obtained through cookies by such third parties.
Finally, information voluntarily disclosed online in discussion areas and other public areas of HFHN’s website or on HFHN-sponsored pages on social media sites can be collected, used and disclosed by third parties. Any submissions made to discussion areas of other public areas on HFHN’s website of on HFHN-sponsored pages on social media sites are done at the user’s risk and with the understanding that such information may be accessible to third parties. HFHN cannot control and will not be liable for any damages that may arise from such user activity.
Changes to Privacy Policy
HFHN reserves the right to modify this Privacy of Information Policy at its sole discretion. In particular, the Privacy Officer will regularly review and suggest modifications to the Privacy of Information Policy in response to developments and changes in privacy law. Any modifications shall be effective immediately upon its publication by any means, including posting on HFHN’s website. The supporter agrees to regularly review the Privacy of Information Policy posted on HFHN’s website, be aware of any modifications and be bound by the same.
RESPONSIBILITY
The Board of Directors is responsible to ensure that someone is appointed to the position of Privacy Officer, and that the person so appointed understands this policy, and their responsibilities in implementing the policy in HFHN. In the absence of a Privacy Officer, this role will fall to the Secretary of the Board, until a new Privacy Officer is appointed. The ED has a responsibility to make sure that each supervisor understands this policy and its application and in turn ensures that their staff and volunteers are also aware and understand this policy and its application as it pertains to their work with HFHN.
RATIONALE
HFHN is dedicated to protecting the privacy of anyone involved or donating to the organization and maintaining the trust that has been placed in it. As such, the privacy policy incorporates the highest standards as set out in federal and provincial legislation across Canada.