Thank you for providing your feedback - and for helping us serve you better
Introduction
Access Communications Co-operative Limited is a non-profit organization which provides local community programming, television, Internet, phone and home security services. As a not-for-profit community-owned co-operative, 100% of its earnings are reinvested in the communities it serves. Access Communications serves over 200 Saskatchewan communities.
In order to maintain and enhance the services available to customers, Access Communications must collect and use personal information. Access Communications occasionally makes use of third-party marketing companies who would have access to personal information. These compa- nies are bound by confidentiality requirements and they are required to use the information only for those purposes specified by Access Communications.
By developing and adopting this industry privacy code (Code), Access Communications is demonstrating its commitment to protect the personal information of both customers and employees. The Code consists of ten interrelated principles to which Access Communications practices must adhere.
This Code outlines the guidelines by which Access Communications operates to protect the privacy of customers’ and employees’ personal information.
This Code conforms to the requirements set out under Part 1 of the Personal Information Protection and Electronic Documents Act, which came into force on January 1, 2001.
Principle 1: Access Communications’ accountability
Access Communications is responsible for all personal information under its control, including personal information disclosed to third parties for processing. Access Communications shall designate an individual who is accountable for the co-operative’s compliance with this Code.
1.1 One individual within the co-operative is responsible for Access Communications compliance with this Code even though other individuals within the co-operative may be responsible for the day-to-day collection and processing of personal information. Other individuals within the co-operative may be delegated to act on behalf of the designated individual.
1.2 The identity of the individual designated by Access Communications to oversee the co-operative’s compliance with this Code shall be made known internally and shall be made available to customers upon request.
1.3 Access Communications shall use contractual or other means to protect personal information that has been disclosed to third parties for processing, for example, for billing, tuning or home internet security purposes.
1.4 Access Communications shall implement policies and practices to give effect to this Code, including:
a) implementing procedures to protect personal information;
b) establishing procedures to receive and respond to complaints and inquiries;
c) training staff to understand and adhere to the co-operative’s policies and procedures; and
d) informing staff and customers of the co-operative’s policy and procedures.
Principle 2: Identifying the purposes for personal information collection
Access Communications shall identify the purposes for which personal information is collected at or before the time the information is collected.
2.1 Access Communications collects personal information for the purpose of providing cable television, phone, Internet services, the marketing and delivery of new communications and related services, community programming, co-operative membership and purposes required or permitted by law. Access Communications does not rent, sell or trade mailing lists for any reason.
2.2 Access Communications collects this information when a customer requests or changes service. Employee information is collected upon hiring. At the time that the information is collected the customer or employee shall be advised of the use of the information. At any time, a customer or employee may expect an explanation of how their personal information is being used.
2.3 In order to provide certain services, Access Communications may transfer to its service provider personal information required by them in order to provide their service, including tuning data. Our provider may (i) anonymize and/or de-identify any personal information and any other information received via their services, and use such anonymized and/or de-identified information for trend analysis and market reports and to develop new, and improve existing, products and services or develop partnerships with third-parties for the same purpose (and the provider will own all aggregated and anonymized and/or de-identified data developed by themselves as a result of their provision of the services, and all products and services based thereon, except, the provider shall not be permitted to sell any such aggregated data on a stand-alone basis (but may incorporate the data into any product, service or report distributed or otherwise sold to any person or entity)) and (ii) use any such information to comply with law. The provider shall not otherwise sell or disclose to any person or entity any personal information of Access Communications customers.
2.4 If Access Communications proposes to use personal information for a purpose not previously identified the new purpose shall be identified and documented prior to the new use, as in 2.1. Unless the new purpose is required or permitted by law, the consent of the customer is required before the information can be used for that purpose. (See Principle 3 below - Consent)
Principle 3: Obtaining consent
Access Communications shall obtain consent from their customers and employees before or when they collect, use, or disclose personal information, except where inappropriate. Access Communications shall make reasonable efforts when obtaining consent to ensure that customers and employees understand how personal information will be used and disclosed by the co-operative.
3.1 Consent is required for the collection of personal information and the subsequent use or disclosure of this information. In most cases, Access Communications will seek consent for the use or disclosure of the information at the time of collection. When Access Communications wants to use information for a purpose not previously identified, consent with respect to use or disclosure may be sought after the information has been collected, but before it is used.
3.2 Access Communications may collect, use, or disclose personal information without a customer’s knowledge or consent in instances where legal or security reasons, or the welfare of an individual, might make it impossible or impractical to seek consent. All of the circumstances where Access Communications may collect, use, or disclose personal information without a customer’s knowledge or consent are as specified and permitted by legislation.
3.3 Access Communications shall ensure that a customer applying for service is made aware of why the co-operative needs the personal information and how the personal information will be used. To make the consent informed and meaningful, the purposes must be stated so that a customer can reasonably understand how the information will be used or disclosed.
3.4 Access Communications may not, as a condition of providing service, require a customer to consent to the collection, use or disclosure of personal information beyond that required to provide the service itself.
3.5 Consent can be either express or implied. The form of consent sought by Access Communications may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, Access Communications shall take into account the sensitivity of the information and the reasonable expectations of the customer. Access Communications will generally seek express consent when the information is likely to be considered sensitive. Implied consent is typically appropriate when the information is less sensitive.
3.6 Customers can provide consent in many ways. For example:
a) an application form may be used to seek consent, collect information and inform the customer of the purposes for which the information will be used. By completing and signing the form, the customer is giving express consent to the collection and use of the information for the specified purposes;
b) a check-off box may be used to allow customers to request that their names and addresses not be used or disclosed for secondary or non-related purposes. Customers who do not check
the box are assumed to have given implied consent for use of their personal information for the specified purposes;
c) express consent may be given orally when information is collected over the telephone; however a written record should be made of such consent or refusal;
d) consent may be given at the time that customers use a product or service and, in such cases, the decision of an individual to use a product or service may constitute express or implied co sent to the collection, use or disclosure of personal information for the specified purposes.
3.7 Customers may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Access Communications shall inform customers of the implications of withdrawing consent.
3.8 Consent to collect and maintain information about employees will normally be obtained at the time of recruitment. Except in circumstances specified and permitted by legislation, other information related to the employee’s service with the co-operative will be added to an employee’s file with the employee’s knowledge.
Principle 4: Limiting the collection of personal information
The collection of personal information by Access Communications shall be limited to that which is necessary for the purposes identified by the co-operative. Information shall be collected by fair and lawful means.
4.1 Access Communications shall collect only the amount and type of personal information needed for specified purposes that have been documented by the co-operative and identified to customers and employees. Access Communications shall specify the type of personal information collected as part of their information management policies and practices.
4.2 Access Communications shall not mislead or deceive customers or employees about the purposes for which personal information is being collected.
Principle 5: Limiting use, disclosure, and retention of personal information
Personal information shall not be used or disclosed by Access Communications for purposes other than those for which it was collected, except with the consent of the customer or an employee, or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.
5.1 Access Communications may share Customers’ Personal information with its partners, associates and third party service providers as provided in Principle 3- Obtaining Consent in order to fulfill the purposes identified in Principle 2 - Identifying the purposes for personal information collection. In such cases, the relationship with the partner, associate or third party is governed by strict confidentiality standards and policies to ensure that the Customer’s Personal Information is secure and treated in accordance with PIPEDA and with the utmost care and respect.
In the event that a third party service provider is located in a foreign country, Customer and Employee Personal Information may be processed and stored in such other foreign country. In such circumstances, the governments, courts or law enforcement or regulatory agencies of that country may be able to obtain access to your Personal Information through the laws of the foreign country. Whenever Access Communications engages a third party service provider, we require that its privacy and security standards adhere to this Privacy Policy and applicable Canadian privacy legislation.
5.2 Access Communications has a records retention policy that specifies the length of time that any records must be maintained. All personal information is accessible only by Access Communications personnel, or third party companies, who need access to that information for the completion of their work.
5.3 Access Communications destroys, erases, or makes anonymous personal information that is no longer required to fulfill the identified purposes.
Principle 6: Keeping personal information accurate Access Communications shall keep personal information as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used.
6.1 Information shall be sufficiently accurate, complete, and up-to-date so as to minimize the possibility that inappropriate information may be used to make a decision about the customer or employee.
6.2 Access Communications shall keep personal information that is used on an on-going basis, including information that is disclosed to third parties, accurate and up-to-date.
6.3 Access Communications shall not routinely update personal information where such information is not needed to fulfill the purposes for which it was collected.
Principle 7: Safeguarding personal information
Access Communications shall protect personal information with security safeguards appropriate to the sensitivity of the information.
7.1 The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification, regardless of the format in which the information is held.
7.2 Customer information is kept in paper and electronic forms that are accessible only to those who require it to perform their duties. Employee information is maintained by Human Resources.
7.3 Access Communications shall make their employees aware of the importance of maintaining the confidentiality of personal information.
7.4 Access Communications shall dispose of personal information in a manner that prevents unauthorized parties from gaining access to the information.
Principle 8: Being open about policies and procedures
Access Communications shall make readily available to customers and employees specific information about their policies and procedures relating to the management of personal information.
8.1 Access Communications shall be open about their policies and procedures with respect to the management of personal information. Customers and employees shall be able to acquire information about a co-operative’s policies and procedures at minimal cost and without unreasonable effort.
This information shall be made available in a form that is generally understandable.
8.2 The information made available by Access Communications shall include:
a) the name, title and address of the individual who is accountable for a co-operative’s policies and procedures and to whom complaints or inquiries can be forwarded;
b) the means of gaining access to personal information held by a co-operative;
c) a description of the type of personal information held by a co-operative, including a general account of its use;
d) a copy of any documents that describe the co-operative’s privacy policies, standards, and/or codes; and
e) a description of personal information made available to agents.
Principle 9: Providing access to personal information
Upon written request, and unless prohibited by law, Access Communications shall inform customers and employees of the existence, use, and disclosure of their personal information and provide access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
9.1 Upon written request, Access Communications shall inform a customer or employee whether or not the co-operative holds personal information about them, and should indicate the source of this information. If the co-operative possesses such information, it shall allow the customer or
employee access to this information. In addition, the co-operative shall provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed.
9.2 Access Communications may require a customer or employee to provide sufficient information to permit the co-operative to provide an account of the existence, use, and disclosure of personal information. The information provided shall only be used for this purpose.
9.3 In certain situations, Access Communications may not be able to provide access to all the personal information it holds. Exceptions to the access requirement are limited to those allowed or required under law.
9.4 In providing an account of third parties to which it has disclosed personal information, Access Communications shall attempt to be as specific as possible. When it is not possible to provide a list of the actual organizations to which it has disclosed information, Access Communications shall provide a list of organizations to which it may have disclosed information.
9.5 Access Communications shall respond to a customer or employee request within a reasonable time and at minimal or no cost. The requested information shall be provided or made available in a form that is generally understandable.
9.6 When a customer or employee successfully challenges the accuracy or completeness of personal information, Access Communications shall correct, delete, or add information as required. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question.
9.7 When a challenge is not resolved to the satisfaction of the customer or employee, Access Communications shall record the substance of the unresolved challenge in the personal information relating to the customer or employee. Where appropriate, the existence of the unresolved challenge shall be transmitted to third parties having access to the information in question.
Principle 10: Challenging compliance
An Access Communications’ customer or employee shall be able to address a challenge concerning compliance with the above principles to the designated individual accountable for the Access Communications’ compliance.
10.1 Questions, concerns or complaints about privacy at Access Communications should be forwarded to:
Access Communications Attention: Privacy Officer 2250 Park Street
Regina, Saskatchewan S4N 7K7
10.2 Access Communications shall investigate all complaints. If a complaint is found to be justified, the co-operative shall take appropriate measures, including amending its policies and procedures if necessary.
10.3 If Access Communications customers or employees are not satisfied with Access Communications’ response, they may contact the Office of the Privacy Commissioner of Canada at: Toll-free:1-800-282-1376 or mail to:
Office of the Privacy Commissioner of Canada 30 Victoria Street
Gatineau, Quebec K1A 1H3
