Rationale and Relationship to Mission, Principles and Values
MS Canada recognizes an individual’s right to privacy and is committed to maintaining the accuracy, confidentiality and security of the personal information in its custody. In pursuit of our mission, MS Canada pledges to treat everyone with respect and dignity and protect their privacy.
MS Canada adheres to the highest standards of quality, transparency, and accountability. To demonstrate this commitment, the organization has developed policies and procedures about the collection, use and disclosure of information that align with federal and provincial legislation and with industry standards.
Policy Objective
This Policy acts as the articulation of MS Canada’s privacy practices and standards about the collection, use and disclosure of personal information and personal health information in the course of its activities. It is intended to guide all staff, volunteers and third parties who are given access to personal information in MS Canada’s possession.
As used in this Policy, the term ‘personal information’ is inclusive of personal health information, unless the latter term is used exclusively. In that case, it applies only to personal health information.
Policy Application
This policy applies to volunteers and staff at all levels and locations of MS Canada.
In addition, MS Canada requires that any individual or third party who collects, uses or discloses personal information on behalf of the organization complies with the provisions of this policy in relation to the respective work.
Policy Details
A. MS Canada property
Any and all records referred to in the document as being personal information or personal health information are, and will remain, the property of MS Canada. Volunteers and staff are required to maintain the privacy and confidentiality of all records in any and all formats both while acting as an active volunteer or staff member and after they leave MS Canada.
B. Compliance with relevant legislation
MS Canada will comply with all applicable provisions of privacy legislation.
Federal and provincial privacy legislation
MS Canada considers the Personal Information Protection and Electronic Documents Act (PIPEDA) - the federal privacy law for private-sector organizations - the standard by which personal information should be protected. PIPEDA sets out the rules for how business must handle personal information in the course of commercial activities. Most MS Canada activities are not “commercial activities” as defined by PIPEDA. One MS Canada activity that is regulated under the provisions of PIPEDA is “the selling, bartering or leasing of donor, membership or other fundraising lists”; as from time to time, MS Canada exchanges donor lists (name and address only) with like-minded organizations.
In provinces and / or territories with more stringent privacy policies, MS Canada activities within those jurisdictions should meet the requirements of both the provincial / territorial legislation and PIPEDA.
Personal health information legislation
MS Canada considers information about whether a person has multiple sclerosis to be personal health information. Several Canadian provinces have legislation specific to the privacy of health information which has been declared substantially similar to PIPEDA with respect to health information custodians. While MS Canada is not a health care custodian by law, it has voluntarily adopted elements outlined in personal health information legislation.
Canada’s Anti-Spam Legislation (CASL)
This policy supports MS Canada’s compliance with Canada’s Anti-Spam Legislation.
In each e-mail communication, MS Canada will include an opt-out feature and instructions on how to un-subscribe if individuals no longer wish to receive future e-mails from MS Canada. If individuals do not expressly consent to receiving electronic communications, MS Canada will only communicate with them for the limited purposes permitted under CASL.
C. Personal and health information collected
To achieve its mission, MS Canada collects certain personal information about its members, donors, clients, event participants, staff, and volunteers; meeting legal obligations and as otherwise permitted or required by law. Such information enables MS Canada to deliver programs and services, pursue government relations and advocacy initiatives, deliver MS public education, fundraise, process donations, administer memberships, conduct marketing efforts, undertake statistical reporting, etc.
MS Canada collects the minimum amount of information needed to establish and maintain a service, volunteer, participant, donor or program relationship with an individual. Subject to the application of the consent principle outlined in Section 3 below, personal information collected by MS Canada may include, but is not limited to:
- Contact and identification information, such as name, address, telephone
number and email address; - MS diagnosis;
- A brief summary of the service requested and or received (programs and services database), responses to program-specific registration questions;
- Membership status and history (date when one became a member, current membership status, etc.);
- Participation in MS Canada advocacy online campaigns and fundraising events;
- Donation information such as date of gift, amount of gift, the campaign to which one contributed;
- Financial information such as payment methods and preferences, billing and banking information (IP address, credit card number and expiry date or chequing account transit numbers which are required to process a donation). We may provide restricted information (name, address, partial credit card number) for administrative purposes to vendors located in the United States;
- Personal information that was not requested but was voluntarily given to us;
- Other personal information used for purposes that a reasonable person would consider appropriate in the circumstances.
D. Privacy and Confidentiality Principles
MS Canada will abide by the following 10 principles when collecting, using and
disclosing personal information:
1. Accountability
MS Canada is responsible for the personal information under its control.
1.1 MS Canada will designate, by the Executive Champion of this policy, a chief privacy officer to ensure the compliance with this Policy.
1.2 MS Canada will implement practices and procedures to carry out the policy, including:
a) Implementing procedures to protect personal information;
b) Establishing procedures to receive and respond to complaints and inquiries from individuals regarding their personal information;
c) Training volunteers and staff and communicating to volunteers and staff information about this Privacy and Confidentiality policy and practices; and
d) Developing information to explain its Privacy policy and practices to staff, volunteers, and the general public.
2. Identifying Purposes
MS Canada will identify the purposes for which personal information is collected. The identified purposes will be specified at or before the time of collection to the individual from whom the personal information is collected. When personal information that has been collected is to be used for a purpose not previously identified, MS Canada is obligated to communicate the new purpose to each individual and obtain their consent to use the information.
3. Consent
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where consent is not required for very specific reasons. It is anticipated that instances in which knowledge and consent of the individual would not be required would be extremely rare and would include legal, medical or security reasons which would have to be fully documented.
Consent is considered valid only if it is reasonable to expect that individuals to whom MS Canada’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure, to which they are consenting.
3.1. Typically, MS Canada staff and volunteers will seek consent for the use or disclosure of the information at the time of collection. The form of the consent sought by the MS Canada may be either express or implied, depending upon the circumstances and the sensitive nature of the personal information.
3.2. Express consent is required from an individual before MS Canada will disclose personal health information about that individual to an external organization or individual. Express consent can be provided verbally or in writing.
3.3. The provision of personal information to MS Canada constitutes implied consent to collect, use and disclose their personal information in accordance with this policy, unless an individual expressly instructs otherwise.
Implied consent can also be inferred where there is an existing (i.e. past two years) business or non‐business relationship between an individual and MS Canada. Examples include but are not limited to: a donor, a volunteer, a member, an event participant, a research grant applicant, someone who has contacted MS Canada for services, etc.
Implied consent is considered to be sufficient for fundraising purposes to allow the trade of limited personal information (name and home address only) about a donor to another charitable organization if the individual has been informed that their personal information might be used in this manner and they have been given an opportunity in a clear and meaningful way to opt-out.
Implied consent is also considered sufficient for relevant commercial electronic messages (CEM) under CASL, provided the individual receiving the message has interacted with MS Canada in the immediate two‐year period the day before the CEM is sent to the them, the sender clearly identifies themselves and the CEM receiver has been given an opportunity in a clear and meaningful way to opt-out. Commercial electronic messages sent by MS Canada that have fundraising as the primary purpose are exempt from CASL.
3.4. No consent: There are certain activities for which consent is not required to use or disclose personal information. These activities are permitted or required by law. For example, we do not need consent from individuals to (this is not an exhaustive list): respond to legal proceedings or comply with mandatory reporting obligations, investigations / fraud detection and prevention, witness statements in insurance claims, financial abuse, personal information produced in the course of employment, business or profession, or other as identified by law from time to time.
MS Canada may use or disclose personal information without consent where MS Canada believes, upon reasonable grounds, that it is necessary to protect the rights, privacy or safety of an identifiable group or person or the public.
3.5. Withholding or Withdrawal of Consent: If consent is sought, an individual may choose not to give consent (“withholding consent”). If consent is given, an individual may withdraw consent at any time, but the withdrawal cannot be retrospective. The withdrawal may also be subject to legal or contractual restrictions and reasonable notice.
4. Limiting Collection
The collection of personal information will be limited to that which is necessary for the purposes identified by the MS Canada. Information will be collected by fair and lawful means.
5. Limiting Use, Disclosure and Retention
Personal information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information will be retained only as long as necessary for the fulfillment of those purposes.
Whenever possible, access to personal information will be limited to authorized users only. Personal information may only be used within the limits of each staff and volunteer role. Staff and volunteers may not read, look at, receive or otherwise use personal information unless they have a legitimate “need to know” as part of their position.
Personal information may only be disclosed within the limits of each staff / volunteer role. Staff and volunteers may not share, talk about, send to, or otherwise disclose personal information to anyone else unless that activity is an authorized part of their position.
Personal health information that is no longer required to fulfill the identified purposes will be destroyed, erased, or made anonymous safely and securely. When MS Canada discloses personal information to third-party service providers with whom it has a contractual relationship, the third-party providers will only be given access to personal information that is needed to perform the related function and may not use it for any other purpose.
Third Parties Outside Canada: MS Canada may use service providers, data processors and other third parties (“Third Parties”) to perform services on its behalf. These Third Parties may store, process and transfer personal information on servers located outside of Canada in jurisdictions whose data protection laws may differ from those of Canada, which may include the United States of America. As a result, personal information may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to the laws in those jurisdictions. For example, information may be shared in response to valid demands or requests from government authorities, courts and law enforcement officials in those countries. Subject to applicable laws in such other jurisdictions, MS Canada will use reasonable efforts to ensure that appropriate protections are in place to require Third Parties to maintain protections on personal information that are equivalent to those that apply in Canada.
Cookies: MS Canada may use automatic data collection technology and services that record and collect information that identifies users’ computers, tracks use of the websites and collects certain other information about users and their surfing habits. This data collection technology may include cookies, web beacons and other similar devices on MS Canada websites to enhance functionality and navigation for visitors to MS Canada websites.
A cookie is a small data file that is placed on the hard drive of a user’s computer so that their computer will “remember” information when visiting a site. Web beacons and tags are small strings of code that are used in conjunction with a cookie and allow MS Canada to record activity on the websites. Internet tags, graphic tags and similar web beacon type functions allow MS Canada to count the number of users who have visited a particular web page or to access certain cookies. MS Canada may use web beacons on their websites to count users and to recognize users by accessing cookies. Being able to access cookies allows MS Canada to personalize the websites and improve individuals’ experience. MS Canada may also include web beacons in HTML-formatted e-mail messages that are sent to determine which e-mail messages were opened.
Information tracked through these mechanisms includes, but is not limited to: (i) IP address; (ii) the type of web browser and operating system being used; (iii) the pages of the website a user visits; and (iv) other sites a user visited before visiting MS Canada websites.
Individuals can reject or disable cookies by managing their browser. Cookies and web beacons do not collect or contain personal information.
Targeted advertising: As individuals/users interact with MS Canada websites, third party advertising partners may use cookies that are placed on user’s computer, tracking pixels, web beacons and similar technologies to identify users as a visitor to the websites, and present users with targeted ads to help promote MS Canada. Users can opt-out of the use of information for select ad targeting by visiting this site: http://youradchoices.ca/choices, and also by setting up “Do Not Track” options available through their browser. MS Canada also occasionally provides personal information to trusted advertising partners for the purpose of presenting the user with targeted ads on behalf of MS Canada. Users can request that their personal information not be shared with advertising partners by contacting priv@mscanada.ca
Google Analytics: MS Canada’s website uses Google Analytics, a web analytics service of Google, Inc. ("Google"), or comparable technology. Google Analytics uses "cookies", which are text files stored on users’ computer, to analyze how they use the website. The information generated by the cookie about use of the websites (including IP address) is sent to a Google server in the U.S. and stored there. Google will use this information to evaluate use of MS Canada website, compile reports on website activity for website operators and to provide other site activity related to internet services. Additionally, Google may transfer this information to a third party when required by law or in the case of a third-party processing information on Google's behalf. In no case will Google use users’ IP address in connection with any other information held by Google. Users can set their internet browser to prohibit the installation of cookies, although some features and functions of the website will then be unusable. By using MS Canada website, users consent to the processing of user data collected by Google in the manner described and for the above mentioned purpose. The consent for collection and storage of data can be withdrawn at any time in the future by clicking on the following link: https://tools.google.com/dlpage/gaoptout?hl=en. MS Canada website uses the "Anonymize IP" function of Google Analytics which works with a shortened form of IP addresses to avoid direct personal identification.
MS Canada uses cookies to carry out frequency assessments, page usage assessments and marketing assessments. For the aforementioned assessments, MS Canada utilizes this cookie information without a link to users’ personal information.
User Content in Comments, Chat Rooms and Message Boards: Personal information voluntarily disclosed through message boards, chat rooms, comment boxes or other interactive areas can be collected and used by other internet users. This may result in unsolicited messages from other posters or parties. MS Canada can undertake no obligations as to the security of information voluntarily posted in chat rooms, on message boards, in comment sections of the website or in other interactive features of MS Canada website.
6. Accuracy
MS Canada will take reasonable steps to ensure that personal information in its custody is accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. Personal information that is used on an ongoing basis, including information that is disclosed to third parties, will generally be accurate and up-to-date, unless limits to the requirement for accuracy are clearly set out. Individuals will always have the opportunity to contact MS Canada to update their personal information.
7. Safeguards
MS Canada will use appropriate security safeguards (depending on the sensitivity of the information) to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification, regardless of the format in which it is held. Safeguards will include: physical safeguards (such as locked filing cabinets and rooms); organizational safeguards (such as permitting access to personal health information by staff on a "need-to-know" basis only); and technological safeguards (such as the use of passwords, encryption, and audits).
MS Canada requires that any individual or third-party who collects, uses or discloses personal information on behalf of the organization complies with the provisions of this policy. This will be done through the signing of confidentiality agreements, privacy training and other contractual means.
Care will be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.
8. Openness
Information about MS Canada privacy policies and practices relating to the management of personal information will be available to the public, including:
- a) Contact information for our Chief Privacy Officer, to whom complaints or inquiries can be made;
- b) The process for obtaining access to personal information held by MS Canada, and making requests for its correction;
- c) A description of the type of personal information held by MS Canada, including a general account of our uses and disclosures; and
- d) A description of how an individual may make a complaint to MS Canada.
- e) Copies of any brochures or other information that explain MS Canada’s policies, standards, or codes.
9. Individual Access
If an individual requests, MS Canada will inform them of the existence, use, and disclosure of their personal information. The individual will be given access to that information, will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
In certain situations, MS Canada may not be able to provide access to all the personal information it holds about an individual. Exceptions to the access requirement will be limited and specific. The reasons for denying access will be provided to the individual upon request. Exceptions may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege.
10. Challenging Compliance
An individual will be able to address a challenge concerning MS Canada’s compliance with its own Privacy and Confidentiality Policy to the chief privacy officer.
The chief privacy officer will receive and respond to complaints or inquiries about organizational policies and practices relating to the handling of personal information as outlined in the Privacy Breach Management Procedures document. They will inform individuals who make inquiries or lodge complaints of other available complaint procedures.
MS Canada will investigate all complaints. If a complaint is found to be justified, MS Canada will take appropriate measures to respond.
Executive Champion
The President and CEO is the executive champion for this policy direction.
Monitoring and Compliance
The President and CEO is responsible for leading the monitoring of the application of and compliance with this policy direction and the related procedures in conjunction with other members of the Executive Team.
On an annual basis, board members and all staff must acknowledge compliance with this policy direction and the related procedures.
This policy is subject to change due to legal and regulatory requirements, introduction of new technologies, business practices and stakeholder needs.
Related Policies, Legislation
Federal Personal Information Protection and Electronic Documents Act (PIPEDA)
Provincial privacy laws
Canada’s Anti-Spam Legislation (CASL)
Privacy and Confidentiality Procedures
Privacy Breach Management Procedure
Retention of Records Procedure
Code of Conduct and Ethical Behaviour
IT Security Policy direction and related procedures
Resolving stakeholder concerns Policy
CASL: What you need to know and do
Policy Review
The policy direction is to be reviewed at a minimum every three (3) years following its approval, or sooner if there is a change in legislation which will affect this policy.
- Reviewed and approved June 2017
- Reviewed and approved May 2021
DEFINITIONS:
Privacy – the fundamental right of an individual to control information about ourselves (including the collection, use and disclosure of and access to that information).
Confidentiality – an obligation to protect personal information, to maintain its secrecy and not misuse or wrongfully disclose it.
Personal information – Personal information is any information about an identifiable individual, other than an individual’s business title, address or telephone number. Examples of personal information are: name, home address, age, health and financial information. It does not include information that cannot be tracked back to a specific individual. In addition, information that is publicly available, such as a telephone book listing, is not considered to be personal information. The history of an individual’s donations to MS Canada is personal information.
Personal health information – Personal health information is defined to mean, with respect to an individual, whether living or deceased:
a) Information concerning the physical or mental health of the individual;
b) Information concerning any health service provided to the individual;
c) Information concerning the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of an individual;
d) Information that is collected in the course or providing health services to the individual; or
e) Information that is collected incidentally to the provision of health services to the individual.
Executive Team – The most senior level of staff leadership within MS Canada comprised of the president and chief executive officer; presidents; senior vice-president(s) and vice-president(s). One person may hold more than one position.
The president and chief executive officer may alter the composition of the executive team as required from time-to-time.