Universities Canada is committed to the protection of personal information and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial and international privacy legislation. This policy applies to all business functions of Universities Canada, including University Affairs and Scholarship Partners Canada.
Universities Canada is responsible for all personal information under its control, including personal information disclosed to third parties for processing. Privacy Impact Assessments are conducted for any activity which may potentially involve personal information, prior to the activity beginning.
Universities Canada has appointed a Privacy Officer who is accountable for the organization’s privacy program, for conducting Privacy Impact Assessments and for compliance with this Policy.
Heather Cayouette, CIPP/C, CIPT
Other individuals within Universities Canada may be responsible for the day-to-day collection and processing of personal information and may be delegated to act on behalf of the Privacy Officer, where appropriate.
Identifying the purposes for collection of personal information
Universities Canada will clearly identify the purposes for which personal information is collected, used, disclosed, and retained before or at the time the information is collected. General purposes for the collection of personal information by Universities Canada are:
- to ensure efficient operations and effective communications with stakeholders and the public;
- to develop aggregate information and statistics on subjects related to higher education and to help inform policy and advocacy directions;
- to allow users to subscribe to mailing lists, newsletters and to receive University Affairs magazine;
- to allow users to register for events organized by Universities Canada;
- to process and evaluate scholarship applications, select recipients and administer payments;
- to audit and assess the efficacy of programs and publications administered by Universities Canada;
- to provide and administer payroll and benefits services to other employers in the higher education sector;
- to market publications of interest to the higher education sector; and
- to identify and offer information services and products to meet stakeholders’ needs or preferences.
More specific purposes for the collection of personal information, if applicable, will be identified to the user at the time of collection.
Universities Canada will always obtain the consent of individuals before or when it collects, personal information, unless an exception is authorized by law. As part of the consent process, Universities Canada will identify the purposes for which personal information will be collected, used, disclosed, and retained.
If Universities Canada proposes to use, disclose or retain personal information for a purpose not identified at the time of collection, subjects will be notified, and consent obtained and documented prior to the new use.
An individual may withdraw their consent at any time, subject to legal or contractual restrictions and reasonable notice. Individuals may withdraw their consent by contacting Universities Canada. Withdrawal of consent may result in the removal of the individual from the program or service.
Limiting the collection of personal information
Universities Canada will only collect the personal information which is necessary for the purpose(s) identified and collects personal information primarily from individuals directly. Universities Canada may also collect personal information from other sources including:
- publishers, list brokers or other associations;
- scholarship and program administration clients;
- authorized representatives of employers using Universities Canada’s payroll and benefit services.
Before collecting personal information from a third party, Universities Canada requires the source to obtain written, informed consent from the individual, to share their personal information with Universities Canada.
Limiting use, disclosure and retention of personal information
Universities Canada will not use, disclose or retain personal information for purposes other than those identified at the time of collection, unless required or authorized by law. Personal information is only accessible by Universities Canada’s personnel and access is limited to what is required for an individual to perform their duties or services.
Universities Canada, depending on circumstance, may disclose personal information to:
- third party service providers;
- a person acting as an agent for a scholarship applicant or recipient;
- members of a scholarship or program selection committee;
- the sponsor of a scholarship or mobility program administered by Universities Canada;
- employers using Universities Canada’s payroll and benefit services.
Prior to disclosing personal information, Universities Canada requires that a written agreement between parties be signed, describing the responsibilities of both parties in relation to the activities being performed and when applicable, the security standards used to protect the information being disclosed.
Universities Canada’s records, particularly those containing personal information, are only retained as long as deemed necessary for the fulfilment of business and legal obligations. Once those obligations have been met, personal information is either deleted, destroyed, or anonymized.
Universities Canada will make every effort to maintain the accuracy of the personal information it stores, but relies on the individual to provide accurate information. Universities Canada will on request correct inaccuracies during the period of its retention. Where notification of inaccuracies is received, Universities Canada will communicate them to appropriate third parties to whom this information has been disclosed, for correction purposes.
Universities Canada will protect personal information with security safeguards appropriate to the sensitivity of the information. All personal information is required to be stored on Canadian servers, wherever possible. Canadian servers may be located outside of Quebec.
Universities Canada will protect personal information against loss or theft as well as unauthorized access, disclosure, use or modification and will restrict internal access to personnel who require such access to perform their duties.
Personal information transferred to third parties providing services to Universities Canada, is protected through contracts, which are reviewed by the Privacy Officer prior to being signed, to ensure providers adhere to industry accepted privacy and information security practices.
In the event of a suspected privacy breach, Universities Canada’s staff will immediately undertake an investigation to assess the severity of the breach and the risk of serious injury to potentially affected individuals. Should a breach be confirmed, Universities Canada will ensure prompt response and appropriate notification to all potentially affected individuals and the Privacy Commissioner of Canada as soon as feasibly possible. Where applicable laws, such as the General Data Protection Regulation (GDPR) or contracts contain additional requirements (e.g. notification within 72 hours), Universities Canada shall comply with those requirements. All incidents will be recorded, reviewed, and appropriate action will be taken to prevent future breaches.
Universities Canada will make readily available information about its policies and procedures with respect to the management of personal information. Individuals will be able to acquire this information at minimal or no cost and without unreasonable effort.
Access to personal information
On written request, and subject to the exemptions stipulated by law, Universities Canada will inform individuals of the existence, use, disclosure and retention of their personal information and provide access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended where inaccuracies exist.
An individual will be able to address a challenge concerning compliance by Universities Canada with this Policy to the Privacy Officer. Universities Canada will investigate all complaints within 30 days of receipt. If a complaint is found to be justified, Universities Canada will take appropriate measures, including amending its policies and procedures if necessary.
Individuals can obtain more information on Universities Canada’s privacy practices, or make a complaint, by contacting Heather Cayouette, CIPP/C, CIPT, Privacy Officer, Universities Canada.
Individuals also have recourse to the Office of the Privacy Commissioner of Canada if they consider that Universities Canada has not responded satisfactorily to their complaint or inquiry.