Protecting Personal Information
Covenant House Toronto is committed to collecting, using and disclosing the personal information of its donors in accordance with this policy.
If you would like to be removed from our mailing list, change the frequency of mailings or request your name not be traded with other charities, contact our Donor Services by:
Telephone: (416) 598-4898 or toll-free 1-800-435-7308
Facsimile: (416) 204-7030
Covenant House Toronto
Attention: Donor Services
20 Gerrard Street East
Toronto ON M5B 2P3
For all other privacy inquiries, contact our privacy officer at firstname.lastname@example.org (Additional contact information below.)
Scope of this Policy
Personal Information Protection and Electronic Documents Act ("PIPEDA")
This Policy sets out the principles that will be observed by Covenant House Toronto (hereinafter "CHT") with respect to the collection, use and disclosure of information about any identifiable individual who is or was a donor or prospective donor. If personal information is made anonymous by removing details so that no individual is identifiable to the user or recipient of that information, this Policy will not apply to that information.
For the purposes of this Policy:
CHT means Covenant House Toronto.
CHT Services includes, but is not limited to, providing clothing, counseling, education, food, housing, medical attention, shelter, and vocational services to homeless youth.
Collect (personal information) – To gather, receive, or obtain personal information from any source outside CHT, by any means.
Client – A person who uses, or applies to use, CHT products or services.
Disclose (personal information) – To make known or reveal personal information by any means.
Donor – An individual who has in the past or may in the future make donations to CHT.
Personal information – Means any information about an identifiable individual, except the individual's name, business address, business phone number and business email address, and includes, but is not limited to, the individual's address, birthdate, gender, employment, bank account number, credit card number, donation history, or other finance-related information. With respect to any specific individual, CHT may or may not have personal information within these enumerated categories.
Third party – A person, organization or association other than CHT or an employee of CHT or a volunteer working at CHT.
Use (personal information) – To review, access, employ or apply personal information for any purpose by and within CHT.
Principle 1 – CHT's Accountability
CHT is responsible for all personal information under its control. Its Privacy Officer is accountable for CHT's compliance with the principles described in this Policy.
The CHT Privacy Officer may be contacted at:
Covenant House Toronto
Attention: Privacy Officer
20 Gerrard Street East
Toronto, Ontario, Canada
Under this Principle, CHT is responsible for personal information in its physical possession or custody, as well as for personal information that is transferred by CHT to a third party for processing. CHT will use contracts with such third parties to require them to give an appropriate level of protection to the personal information while it is being processed.
CHT is establishing and implementing:
- policies and procedures to protect personal information;
- policies and procedures to receive and respond to complaints and inquiries;
- staff training and information programs to explain this Policy and related privacy policies and practices; and
- practices to ensure that clients and other individuals who contact CHT have access to this Policy.
Principle 2 – Identifying Purposes
The purposes for which personal information is collected will be identified and documented by CHT at or before the time the information is collected.
Depending on the specific circumstances, CHT may collect personal information concerning donors for one or more or the following purposes:
- to administer and maintain accounts relating to donations;
- to facilitate fundraising in order to provide the CHT Services;
- to communicate with donors and potential donors concerning CHT and CHT Services;
- to comply with legal and regulatory requirements; and
- to trade or rent fundraising or donor lists.
Circumstances might arise where CHT wishes to collect or use personal information for a new purpose. If that occurs, CHT will take reasonable steps to ensure that the individual concerned is informed of the new purpose and gives his or her consent to the collection or use of personal information for that purpose.
CHT may collect personal information about donors in a number of ways, including:
- personal communications with the donor effected by a Board member, volunteer or employee;
- accessing information which is publicly available;
- accessing information on a donor list created or maintained by another charitable organization;
- renting a mailing list created or maintained by another organization;
- exchanging mailing lists with other registered charities;
- internet research;
- responses to post office mailings;
- responses to newspaper inserts and mail drops;
- receipt of information about memorials, pledges, bequests concerning CHT;
- communications from tax, estate and investment planners; and
- information generated by third party events such as social functions, entertainment, contests and the like.
Principle 3 – Consent
The knowledge and consent of the individual, express or implied, are required for the collection, use or disclosure of personal information by CHT, except where inappropriate.
Except when the under-noted limited exceptions apply, CHT will obtain the express consent of the individual for the purposes for which his or her personal information will be collected, used or disclosed. CHT will state the purposes in a form that the individual can reasonably be expected to understand.
CHT may use personal information to contact donors in a number of ways, including the following:
- personal communications with donors by a Board member, volunteer or employee;
- direct mailings to donors with newsletters, requests for donations;
- direct mailings to prospective donors;
- contacting donors by telephone to thank them for their donation;
- contacting donors by telephone to conduct donor research; and
- trading or renting donor or other fundraising lists.
all of which are intended to advance the objectives of CHT by encouraging individuals to make donations to support CHT services.
CHT staff involved in obtaining the consent of individuals to the collection, use or disclosure of their personal information will be appropriately trained with respect to this Policy.
Withdrawal of Consent
An individual may withdraw his or her consent to collection, use or disclosure at any time, subject to legal or contractual restrictions and reasonable notice. CHT shall inform the individual of the implications of such withdrawal of consent.
In appropriate circumstances, CHT will seek individual consent to the collection, use and disclosure of personal information by notifying individuals that they will be deemed to consent unless they expressly inform CHT to the contrary. CHT will ensure that the individual is entitled to use a convenient method for such notification to CHT, including e-mail, voice-mail and other communication facilities that enable the client to communicate on a 24-hour basis with CHT.
Whatever mechanism is employed by CHT to seek express consent, it will fairly and reasonably draw the individual's attention to the issue of consent.
Disclosure to Service Providers and other Third Parties
CHT may transfer personal information to a third party for processing. In that regard, CHT will ensure such party will provide a comparable level of protection while the information is being processed by such party. This includes any trading or rental of fundraising or donor lists.
Circumstances where the individual's consent is not required CHT may lawfully collect personal information without the knowledge or consent of the individual where:
- collection of the personal information is clearly in the interests of the individual and consent cannot be obtained in a timely way;
- it is reasonable to expect that collection of the personal information with the knowledge or consent of the individual would compromise the availability or accuracy of the information and the collection is reasonable for purposes of an investigation or a proceeding;
- the information is already publicly available and specified in the regulations;
- the collection is required or authorized by law; or
- the information is collected from another organization which collected it with the consent of the individual and the information is collected solely for the purposes for which it was previously collected and to assist that organization.
Further, as permitted by law, CHT may use personal information, without the knowledge or consent of the individual, in circumstances where:
- the use is clearly in the interests of the individual and consent could not be obtained in a timely way;
- the use is necessary for the medical treatment of the individual and the individual does not have the legal capacity to give consent;
- the use with the consent of the individual would compromise an investigation or proceeding and the use is reasonable for purposes related to an investigation or proceeding;
- it is reasonable to believe that the information could be useful in the investigation of a contravention of federal, provincial or foreign law, that has been, is being, or is about to be committed, and the information is used for the purpose of investigating that contravention;
- the information is used for the purpose of acting in respect of an emergency that threatens the life, health or security of an individual or the donor;
- the information is already available to the public and specified in the regulations;
- the use is required or authorized by law; or
- the information was collected from another organization without consent for one of the foregoing reasons, and is used solely for the purposes for which it was previously collected.
With respect to disclosure of personal information without express or implied consent, the CHT, as permitted by law, may disclose personal information without the knowledge or consent of the individual if such disclosure:
- the disclosure is made to a barrister or solicitor who is representing CHT;
- the disclosure is made for the purposes of collecting a debt owed by the individual to CHT;
- the disclosure is made in order to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with the rules of court relating to the production of records;
- the disclosure is made to a government institution or a part of it that has made a request for the information, identified its lawful authority to obtain the information and has indicated that,
- the information is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or the gathering of intelligence for the purpose of enforcing any such law, or
- the disclosure is requested for the purpose of administering any law of Canada or a province;
- the disclosure is made by CHT to an investigative body, a government institution or part of one because CHT believes, reasonably, that the information relates to a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been or is about to be committed;
- the disclosure is made to a person who needs the information because of an emergency that threatens the life, health or security of an individual;
- the disclosure is of information that is publicly available and is specified in the regulations of the Act; or
- the disclosure is required by law.
CHT will notify a client that a subpoena, warrant or court order for the production of his or her personal information has been received, if the law allows it. It may notify clients by telephone or by letter to the client's last known address.
Principle 4 – Limiting Collection
CHT will limit the amount and type of personal information collected to that which is necessary for the purposes identified by CHT.
Although CHT will collect personal information primarily from the individuals concerned, with the individual's consent, CHT may also collect information from external sources such as other charities or other organizations which create or develop mailing list, or as otherwise indicated in Principle 2 above. If personal information is collected from a third party, CHT will note their identity unless there is a lawful reason for not doing so.
Principle 5 – Limiting Use, Disclosure and Retention
CHT will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law. Personal information will be retained only as long as necessary for the fulfillment of those purposes.
Personal information that has been used by CHT to make a decision that directly affects an individual will be retained for at least one year after using it, to allow the individual to have a reasonable opportunity to obtain access to the information.
CHT will retain personal information only as long as necessary for the identified purposes and for legal or business purposes.
CHT specifies in its policies and procedures the shortest and longest periods of time it will keep personal information. Some of these time periods may be determined by legislation.
CHT will destroy, return or make anonymous, any personal information no longer needed for its identified purposes or for legal requirements.
Principle 6 – Accuracy
CHT will keep personal information as accurate and complete as is necessary for the purposes for which it is to be used.
CHT will generally rely on individuals to provide updated information, such as changes to addresses and other contact information. CHT will update personal information as is necessary to fulfill the purposes for which the information was collected.
If an individual successfully demonstrates to CHT that personal information is inaccurate, incomplete, out of date, or irrelevant, CHT will revise the personal information. If necessary, CHT will disclose the revised personal information to third parties which were provided with inaccurate or out-of-date information to permit them to revise their records as well.
Principle 7 – Safeguards
CHT will make reasonable security arrangements to protect personal information.
Security arrangements are employed to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, modification, or disposal. CHT shall protect
personal information regardless of the format in which it is held.
The nature of CHT's safeguards will vary depending on the sensitivity of the personal information that has been collected, the amount, distribution, and format of the information, and the method of storage. The more sensitive personal information will be safeguarded at a higher level of protection.
The methods of protection employed by CHT will include:
- physical measures, including locked filing cabinets and restricted access to offices.
- organizational measures, such as security clearances and limiting access on a "need to know" basis.
- technological measures, such as the use of passwords and encryption.
CHT will inform staff about CHT's policies and procedures for protecting personal information. All staff and volunteers will be required to conform to CHT's policies and procedures concerning the security of personal information.
When CHT discloses personal information to third parties, CHT will require these third parties to safeguard all personal information in a way that is consistent with CHT's Policies and which complies with these principles.
Principle 8 – Openness
CHT will be open about its policies and procedures with respect to management of personal information. CHT will ensure that individuals are able to acquire information about CHT's policies and procedures without unreasonable effort. CHT will make this information available in a form that is generally understandable.
The information made available by CHT will include:
- the name of the Privacy Officer and contact information; and
- the means of gaining access to personal information held by CHT.
CHT will utilize its website to provide access to its Privacy Policies.
Principle 9 – Individual Access
Upon a request in writing, CHT shall inform an individual of the existence, use, and disclosure of his or her personal information and the individual shall be given access to that information, except where the law requires or permits CHT to deny access.
A request for access by an individual to his or her personal information shall be made in writing.
CHT will assist any individual who informs CHT that they need assistance in preparing such a written request to CHT.
CHT may require the individual to provide sufficient information to permit CHT, with a reasonable effort, to provide an account of the existence, use, and disclosure of personal information. The information provided by the individual in response to CHT's request will be used only for this purpose.
CHT will respond to a request within 30 days after receipt of the written request. CHT may extend the time limit for a maximum of 30 days if:
- meeting the time limit would unreasonably interfere with the activities of CHT, or
- the time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet.
In any of the above cases, CHT will, not later than 30 days after the date of the request, send a notice of extension to the individual, advising them of the new time limit and the reasons for extending the time limit.
CHT may respond to an individual's request at a cost to the individual if CHT informs the individual of the estimate of the fee in advance.
Where CHT responds by refusing a request, CHT will inform the individual in writing of the refusal and setting out the reasons.
An individual may challenge the accuracy and completeness of the personal information collected, used or disclosed by CHT about that individual and have it amended, as appropriate.
CHT may deny access by an individual to his or her personal information where:
- the information is protected by solicitor-client privilege;
- it would reveal confidential commercial information;
- to do so could reasonably be expected to threaten the life or security of another individual; or
- the personal information was collected in the course of a formal dispute resolution process.
Where CHT is entitled to withhold access to personal information, and that information is severable from other information for which access is requested, CHT will provide access to the personal information after severing such information.
CHT will not record in a donor's individual file when personal information was disclosed to government agencies as required by law; for example, reporting to Canada Customs and Revenue Agency.
If CHT denies the individual's request for access to personal information, CHT will provide its reasons for denying access. The individual may challenge CHT's decision.
Where CHT is satisfied that an individual has successfully demonstrated that his/her personal information is inaccurate or incomplete, CHT shall correct the information, as required. Where CHT disagrees with making with the requested correction, CHT will annotate the personal information with the correction that was requested but not made.
Principle 10 – Challenging Compliance
An individual will be able to direct a challenge concerning compliance with the above principles to the designated individual or individuals accountable for CHT's compliance.
The individual accountable for CHT's compliance is the Privacy Officer.
CHT will investigate all complaints made to it in writing. If CHT's investigation determines that a complaint is justified, CHT will take appropriate measures, including, if necessary, amending its policies and practices.