NDMAC Privacy Policy
As of January 1, 2004, under the Personal Information Protection and Electronic Documents Act (PIPEDA), NDMAC is required to obtain an individual's consent when they collect, use or disclose the individual's personal information. Under the Act, NDMAC must follow a code for the protection of personal information, which consists of 10 principles of fair information practices.
1- Being Accountable
NDMAC will comply with all 10 principles of the Personal Information Protection and Electronic Documents Act. The President of NDMAC is responsible for ensuring NDMAC's compliance with the Act.
Personal information gathered by NDMAC is kept in confidence. Our personnel are authorized to access personal information based only on their need to deal with the information for the reason(s) for which it was obtained. Safeguards are in place to ensure that the information is not disclosed or shared more widely than is necessary to achieve the purpose for which it was gathered. We also take measures to ensure the integrity of this information is maintained and to prevent its being lost or destroyed. We collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in light of the circumstances.
2- Identifying Purposes
NDMAC collects personal data in order to maintain contact with individuals with whom it has normal business dealings and to fulfill its mandate. For example, NDMAC uses the collected data to:
- Distribute regular business correspondence including newsletters, event notices, meeting notices, membership information, correspondence, submissions;
- Contact individuals via mail, e-mail, telephone, fax;
- Identify groups for the purposes of corresponding (such as categories of memberships, participation on the Board, committees, task forces, and section representatives);
- Maintain records of correspondence;
- Analyze and improve its services and benefits;
- Facilitate communication between the members of the Association.
3- Obtaining Consent
NDMAC considers consent to be an expression of permission to collect and use information for the purpose of providing services, benefits, and information. NDMAC has procedures in place to inform individuals of the purposes for collecting and using personal information, and for obtaining consent to collect and use personal information. Consent may be provided in the form of a written or oral expression of consent or the withdrawal of consent. NDMAC obtains consent in person, and/or by mail, internet, telephone, or fax.
4- Limiting Collection
Personal information is any information that can be used to distinguish, identify or contact a specific individual. Certain information is excluded under the Act: information contained on the business card of an employee of an organization and certain publicly available information, such as that published in public directories. Where an individual uses his or her home contact information as business contact information as well, we consider that the contact information provided is business contact information, and is not therefore subject to protection as personal information.
NDMAC collects personal information only for purposes that a reasonable person would consider appropriate in light of the circumstances. For example, NDMAC collects e-mail addresses so that we can provide services via the internet. NDMAC does not collect information that is extraneous to the efficient operation of the Association. NDMAC does not collect information on behalf of third parties.
5- Limiting Use, Disclosure and Retention
NDMAC only collects personal information for the purpose of maintaining contact and providing services and benefits to business associates. Personal information is retained for as long as NDMAC has a business relationship with the individual. When consent is withdrawn, NDMAC deletes the information from its database.
6- Being Accurate
NDMAC endeavours to keep records as up-to-date as possible to ensure that it is able to fulfill the intended purposes for which the data are collected. Data is obtained directly from the individual, individuals authorized to provide updated data, publicly available directories, and other sources as appropriate. Data is reviewed and updated on an annual basis and throughout the year as updated data is identified.
7- Using Appropriate Safeguards
Personal data is stored on an electronic database in the NDMAC office. A User ID and password is required to access the database. All NDMAC employees have a User ID and password to view, add, delete, modify and use the data. The database is backed up according to technological protocols. NDMAC's office and the building in which it is housed are locked outside of normal business hours.
Contact information is defined as information necessary to identify the business relationship of the individual and to contact the individual, such as name, telephone number, and e-mail address. Contact information is stored on handheld devices belonging to, and secured by, senior NDMAC employees. Contact information for members is also posted in the password-protected section of NDMAC's web site. A User ID and password is required to view and print the information.
8- Being Open
NDMAC takes the management of personal information seriously and makes every reasonable effort to protect it. NDMAC's Privacy Policy is posted on its web site and is available from the NDMAC office at 1111 Prince of Wales Drive, Suite 406, Ottawa, Ontario K2C 3T2; tel.: 1-613-723-0777; fax: 1-613-723-0779; e-mail: info@ndmac.ca If you have questions or comments about NDMAC's Privacy Policy or procedures, please contact the NDMAC Privacy Officer, at info@ndmac.ca or tel.: 1-613-723-0777.
9- Giving Individuals Access
Individuals may contact the NDMAC office to review their personal information records. Correspondence should be sent to the Executive Assistant Communications at info@ndmac.ca or tel.: 1-613-723-0777. An NDMAC employee will be available to answer questions about the requested information. NDMAC will correct incorrect information on a timely basis, usually within 48 hours of notice. There are no costs or charges associated with the correction of information.
10- Challenging Compliance
The easiest method of complaint about NDMAC's enforcement of its Privacy Policy and procedures is to communicate directly with NDMAC's Executive Assistant Communications via letter, fax, e-mail or telephone. In most cases, complaints can be satisfied within 48 hours. Understandably, complaints that involve more than a simple correction or updating of information should be submitted in writing so that both the complainant and NDMAC have a paper trail to follow in accounting for the resolution of the complaint.
Should an individual not be satisfied with the handling of a Privacy Policy complaint by an NDMAC employee, they should bring the complaint directly to the attention of NDMAC's Privacy Officer.
If the complaint is still not satisfied, the complaint should be brought to the attention of the Chair of NDMAC's Board of Directors. And finally, if the complaint is still not resolved, the complaint should be brought to the attention of the Privacy Commissioner of Canada.
