What You Really Need to Know About Privacy

Privacy legislation is designed to protect the right of an individual to control the collection, use, and disclosure of his or her personal information. The legislation sets out how you as a business owner may (and must) collect, use, and disclose the personal information of others.

Personal information is defined as "Any information that would allow an individual to be identified." This includes information such as name, address, gender, birth date, education, employment, income, medical information, and the like. Although there are no specific requirements set forth in the acts, personal information must be treated in a manner appropriate to its sensitivity.

As a business, you must collect only information that you reasonably require, identify the purpose for the information you collect, and keep it safe and accurate. You must also obtain consent before you collect, use, or disclose personal information.

Consent can be obtained in various ways: it may be express (a signed permission slip), implied (an individual volunteers information), or not-opted-out (unless the individual objects, he/she is deemed to consent). The method of consent must be reasonable and appropriate to the type of information being collected and its potential use.

You should only keep personal information as long as necessary for its intended purpose, and then securely dispose of it. That means a secure erasing procedure for your electronic records, and secure shredding for paper records.

Before you disclose personal information, you must obtain consent from the individual. However, a business is obliged to disclose personal information, even without consent, under certain circumstances, including medical emergencies, situations affecting the safety and security of the public, or legal or criminal investigations.

Also, if you disclose personal information to third parties, it is your responsibility to ensure that those parties will treat the information in accordance with the privacy legislation.

Individuals can request access to their personal information at any time. On written request, you must provide complete records of all personal information pertaining to that individual within 45 days.

So what do you need to do in order to comply with privacy legislation? Every business needs:

• A Privacy Policy: Available to all individuals and businesses. It should address the key principles, outline how and when your business collects, uses, retains and discloses personal information, and identify the Privacy Officer.
• A Privacy Officer: A contact for questions and information. The Privacy Officer can be any owner or employee within your business who is familiar with privacy legislation and your Privacy Policy.
• A record of the locations and types of personal information you retain.
• A staff training program: All staff should be trained to recognize personal information, and follow the request and disclosure procedures.

The key to successful compliance with privacy legislation is acting in a reasonable and appropriate manner when collecting, using, retaining and disclosing personal information.

Back to Article Directory

By: Diane Henders, Bright Ideas Personalized Learning Inc. For more information or computer training services, please call Bright Ideas Personalized Learning at 692-2255.

Site Map | Privacy | Careers | FAQ | Contact Us

Copyright © 2008 Bright Ideas Personalized Learning
Bright Ideas Personalized Learning - 303, 6707 Elbow Drive S.W., Calgary, AB T2V 0E5