Category: Corporate Policy

Policy No.:

Revisions:

Pages: 7

Effective Date: May 23, 2019

Report No.: CPS-41-2019

Protection of Privacy and Confidentiality of Information Policy

Purpose:

The purpose of the Protection of Privacy and Confidentiality of Information policy is to;

ensure the protection of personal information and confidential information and how it is collected, retained, used, disclosed and disposed of by Middlesex Centre,
provide a right of access to individuals with respect to personal information about themselves,
ensure individuals have access to information which is not considered to be personal information or confidential information,
establish procedures to assure the public that Middlesex Centre takes privacy and confidentiality of information seriously by taking proactive measures during program development and service delivery,
identify what Personal Information and Confidential Information is, and,
establish investigation and reporting procedures for privacy breaches.

Scope:

All Employees of Middlesex Centre.

Policy:

In accordance with Middlesex Centre’s policies, the Municipal Act, the Municipal Freedom of Information and Protection of Privacy Act (“MFIPPA”); Middlesex Centre (“the Municipality”) will protect the privacy and confidentiality of Personal Information and Confidential Information by ensuring appropriate procedures are in place to collect, retain, use, disclose and dispose of such information.

Procedure:

Definitions

For the purpose of this document, the following terms have the following meanings:

“Confidential Information” is any and all information relating to the business, operations, personnel and affairs of the Municipality and its assets which is not a matter of public record.

“Departments” means any categorical division of service delivery or municipal administration of Middlesex Centre which is officially recognized by Middlesex Centre and exercises powers delegated to it by Middlesex Centre, including but not limited to any local board, as defined by the Municipal Act, 2001 as amended or replaced, which exercises powers delegated to it by Middlesex Centre.

“Information Systems” is any hardware or software system that is used to collect, filter, process, create, store and distribute data.

“Personal Information” is recorded information about an identifiable individual.

“Personal Information Bank” is a collection of Personal Information that is organized and capable of being retrieved by an individual’s name or other individual identifier.

“Privacy Impact Assessment (PIA)” is a process for identifying, assessing and mitigating privacy risks. A PIA is a due diligence exercise to analyze the effects of a technology, system, program or service design on the privacy of individuals.

“Record” is any form of information however recorded, whether in printed form, on film, by electronic means or otherwise held by the Municipality.

Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)

The purpose of MFIPPA as it relates to this policy is to;

Protect individual privacy by:

· Requiring the Municipality to handle Personal Information in accordance with the collection, use, retention, disclosure and disposal rules under MFIPPA.

· Providing the right to Ontarians to complain to the Information and Privacy Commissioner (IPC) if they feel the Municipality has mishandled their Personal Information.

Ensure all persons have a right of access to their Personal Information and can request its correction.

Personal Information

Personal Information shall not be disclosed to anyone except those authorized to use it for purposes which are consistent with the original reason it was collected for.

Personal Information can include, but is not limited to:

· an individual’s biographical details (name, sex, age, race),

· an individual’s biological details (face, fingerprints, blood type, etc.),

· nationality,

· religion,

· marital status,

· education,

· medical or criminal history,

· financial information,

· identifying numbers, for example, Social Insurance Numbers,

· an individual’s contact details (personal address, phone number, etc.) and

· personal opinions and views.

1. All employees, volunteers and members of Council have the responsibility to protect the Personal Information they collect, retain, use, disclose and dispose of during Middlesex Centre business. Personal Information must be secured and protected from unauthorized access at all times.

2. Personal Information must only be used for purposes which are consistent with the original reason it was collected for.

3. Notice of Collection, Privacy Statements and Contact Information shall be communicated to the Public when Personal Information is being collected.

4. Privacy training is mandatory for all employees, volunteers and members of Council who may handle Personal Information.

5. Personal Information shall only be accessed by authorized individuals for the purpose of performing their regular duties.

6. Personal Information shall not be removed from Middlesex Centre’s premises or Information Systems unless the appropriate authorization is provided.

7. If Personal Information must be transported, every effort must be taken to ensure it is secure and protected from unauthorized access or distribution. Refer to Appendix “A” for more details.

8. Personal Information must be treated as Confidential Information.

Confidential Information

Confidential Information shall not be disclosed to anyone except those who are authorized and who require the information for legitimate business purposes.

Confidentiality is demonstrated in the following ways:

· an explicit statement of confidentiality,

· a written or verbal request for confidentiality,

· the Municipality’s treatment of the information as sensitive or confidential.

Confidential Information however identified is only as confidential as how it is treated. Confidential Information must actually be treated as confidential.

Confidential Information recorded on paper, for example, must be:

· stored in secure cabinets (locked when not in use, not in a public space, with access only to authorized persons),

· secured within a file folder / cover paper when outside of the secure cabinet,

· returned to the secure cabinet when not in use, and

· accessed only by authorized staff on a “need to know” basis.

Confidential Information recorded in electronic form, for example, must be:

· protected using passwords and other appropriate methods to restrict access to computers and computer networks,

· protected by encrypted storage media when files are in transit, and

· accessed only by authorized persons on a “need to know” basis.

Confidential Information shall not be removed from Middlesex Centre premises or Information Systems unless appropriate authorization is provided.

Complaints, Breaches and Reporting Requirements

All complaints and/or suspected breaches relating to the inappropriate, inadvertent or unauthorized collection, retention, use, disclosure or disposal of information in ways that are not consistent with MFIPPA or related Municipality policies must be immediately contained, within reason and reported to the designated Privacy Officer.

Departments must have the proper reporting procedures in place which ensure barriers to efficient and effective reporting are minimized.
The loss or theft of Personal Information or Confidential Information must be immediately reported to the designated Privacy Officer so that appropriate action can be taken. For example, if Personal Information or Confidential Information has been lost through theft, the police will be notified.
If someone believes to have inadvertently disclosed Personal Information or Confidential Information, or is unsure if they have done so, the incident must be reported immediately to the designated Privacy Officer.
The Privacy Officer or delegate shall report the loss or theft of Personal Information to the Information and Privacy Commissioner of Ontario.

Location	Designated Privacy Officers
All Middlesex Centre Departments	Middlesex Centre’s Clerk

Privacy Impact Assessment (PIA)

1. Department Heads must ensure that a Privacy Impact Assessment (“PIA”) is completed prior to implementing a new program or significantly changing an existing program that requires the collection, use or disclosure of Personal Information.

2. When a PIA is required, it is the responsibility of the Department Head or delegate to complete the PIA form and provide a copy to the Municipality Clerk, Director of Information Technology Services from the County of Middlesex and Director of Corporate Services for review and feedback.

3. Completed PIA forms must be referred to throughout the project lifecycle to ensure that the protection of Personal Information is maintained.

Personal Information Banks

A Personal Information Bank is a collection of personal information that is organized and capable of being retrieved using an individual’s name or an identifying number or another identifier assigned to the individual. For example, Payroll Database, Accounts Receivable, Accounts Payable.

1. It is the responsibility of the Department Head in the custody and control of the Personal Information Bank to complete a Personal Information Bank Index Form (Appendix C) and submit it to the Municipality Clerk.

2. Any changes relating to the Personal Information Bank must be provided to the Municipality Clerk to ensure accuracy is maintained.

The Municipality Clerk will ensure the Personal Information Bank is indexed, up to date and available on Middlesex Centre’s website.

Department Policies and Procedures

Departments which collect, retain, use, disclose and dispose of Personal Information, Confidential Information or any other information which is protected by privacy legislation, must ensure that the appropriate departmental policies and procedures are in place, including but not limited to the;

access of Personal Information or Confidential Information,
the transportation of Personal Information or Confidential Information,
protecting the privacy of Personal Information or Confidential Information when working outside of their primary office (refer to Appendix A), and,
that employees understand that although they may be authorized to access specific Records within a set of information, they are not entitled to access all information which may be related.

Disposal of Personal Information or Confidential Information

There are a number of commonly accepted ways for departments to properly dispose of Personal Information or Confidential Information depending on the form in which it is being stored. The objective is to permanently destroy the media which stores Personal Information or Confidential Information so that it cannot be reconstructed or recovered in any way. When going through the process of disposal, a department should also destroy all associated copies and backup files.

Information is commonly stored on two types of media, hard (paper) copy or electronic copy.

Personal Information or Confidential Information which is stored on hard (paper) copy must be destroyed using a paper shredder or placed in a confidential document destruction bin.

Personal Information or Confidential Information which is stored on electronic storage media (electronic copy) must be destroyed using approved destruction methods as defined by the Information Technology Services (ITS) department. Please contact the ITS department to obtain an up to date document which outlines the secure and proper destruction methods of electronic storage media. Electronic storage media may also be submitted to the ITS department for the secure and proper destruction of electronic records.

Non-Compliance

Any persons found to be in violation of this policy may be subject to disciplinary action up to and including termination of employment.