Universities Canada provides administrative services for a variety of scholarship and awards programs. This administration role includes, on behalf of the program Sponsor, the collection, use, disclosure and retention of an individual’s personally identifiable information (“Personal Information”) for the purposes of applying, processing, evaluating and selecting of award recipients, the administering of award payments and the assessment of the efficacy of the scholarship (the “Scholarship Administration Purposes”). Personal Information collected by Universities Canada may also refer to names, email addresses and contact information for individuals who have registered an account with the Universities Canada scholarship management portal (“Users”). Universities Canada commits to comply with the requirements of the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”) as follows:
Universities Canada will comply with the requirements of PIPEDA in respect of Personal Information collected, used, disclosed or retained by Universities Canada, or transferred to Universities Canada by the Sponsor in the course of the administration of the program.
Universities Canada has appointed a Privacy Officer with overall responsibility for PIPEDA privacy compliance. Personal information management practices by Universities Canada will be consistent with the fair information principles in the Canadian Standards Association Model Code on the Protection of Personal Information.
2. Notification of purposes
Universities Canada will inform Users about the Scholarship Administration Purposes for the collection, use, disclosure and retention of their Personal Information, in the application materials and on the scholarship management portal. Should a Sponsor collect the Personal Information directly, the Sponsor will be responsible for informing Users about the Scholarship Administration Purposes for the collection, use, disclosure and retention of their Personal Information.
Universities Canada will obtain the consent of Individuals to the collection, use, disclosure and retention of their Personal Information including disclosure to third parties where applicable, for the Scholarship Administration Purposes. Should a Sponsor collect the Personal Information directly, the Sponsor will be responsible for obtaining the consent of the Users for this purpose, including disclosure to third parties where applicable, sufficient to authorize Universities Canada to use or disclose the Personal Information for the Scholarship Administration Purposes.
Both parties will keep records, and make such records available to each other as required, of the consents obtained from the applicants.
4. Limited collection and use
Universities Canada will independently collect Personal Information while providing services for or on behalf of the Sponsor only in compliance with the consent provided by the User. Universities Canada will ensure that it collects only such Personal Information as is required to participate in the program. Universities Canada will use all Personal Information, only in compliance with the consent provided by the User in the Scholarship Application or the scholarship management portal.
Universities Canada will limit the use of Personal Information provided to Selection Committee members to the purposes of selecting successful recipients. The Selection Committee will be prohibited from disclosing Personal Information used or generated during the selection process to any third party. All Selection Committee members will be required to return all Personal Information used or generated by the Selection Committee to Universities Canada upon completion of the selection process. In cases where the Sponsor is dealing directly with the Selection Committee members, Universities Canada will, on request, provide the Sponsor with suggested forms of Selection Committee Confidentiality Agreements for these purposes.
5. Limited disclosure and retention
Universities Canada will not disclose Personal Information about Users to third parties except with the consent of the User as provided in the Scholarship Application or the scholarship management portal or unless required or authorized to do so by law.
Universities Canada will retain Personal Information about Users as consented to by the User and will be handled in three ways:
a) Personal Information concerning Users who have registered an account on the scholarship management portal but have not submitted an application will be deleted from the scholarship management portal and all backup repositories after two years of inactivity.
b) Personal Information concerning Users who have registered an account on the scholarship management portal, applied for a program but were unsuccessful in their application, will have their Personal Identifiers pseudonymized after two years of inactivity.
c) Personal Information concerning Users who have registered an account on the scholarship management portal, applied for a program and received payments as part of the program, will have their Personal Identifiers pseudonymized after seven years of inactivity.
Universities Canada will retain a permanent listing of the internal identification numbers of the individuals indicated in b) and c) above for any given year.
6. Accuracy of personal information
Universities Canada will make every effort to maintain the accuracy of the Personal Information in their possession. Universities Canada will rely on the User to provide accurate Personal Information so as to minimize the possibility that inaccurate Personal Information may be used to make a decision.
Universities Canada will, on request from either the Sponsor or from a User, correct inaccuracies in Personal Information during the period of its retention. Where notification of such inaccuracies is received directly from Users, Universities Canada will communicate them to the Sponsor for correction purposes. Users will be advised that inaccuracies must be brought to the attention of Universities Canada, prior to the selection of a successful recipient in order to record and bring the correction to the attention of the Selection Committee.
Universities Canada will employ reasonable security measures against unauthorized access and misappropriation of Personal Information, regardless of the format in which the Personal Information is held and will restrict internal access to individual Personal Information to personnel who require such access to perform their duties.
In the event of a suspected security breach, Universities Canada’s Programs and Information Technology staff will immediately undertake an investigation to assess the severity of the breach, including an assessment of which information may have been compromised. Should a security breach be confirmed, Universities Canada will notify all potentially affected Users, the Sponsors of those programs and the Privacy Commissioner of Canada within 72 hours of discovering the breach. Universities Canada will then review the incident and ensure appropriate action is taken to prevent future breaches.
8. Openness and training
Universities Canada will train all of their personnel who have access to Personal Information according to their obligations under PIPEDA. For clarity, Universities Canada has adopted a detailed privacy code (“Universities Canada Privacy Code”) and has trained its personnel on the importance of maintaining confidentiality of Personal Information and on the Personal Information management practices implemented in accordance with the Universities Canada Privacy Code. Universities Canada will make the Universities Canada Privacy Code and this Privacy Statement available to the Sponsor and all Users.
Users requesting access to Personal Information held by Universities Canada, will be given access to the Personal Information subject to the exemptions required or stipulated in PIPEDA, and will on request be provided with information as to the history of use and disclosure of that Personal Information.
Should a User wish for Universities Canada to delete their Personal Information, they may do so by contacting the Privacy Officer. If a User’s Personal Information is deleted, they will no longer be able to participate in the program or receive payments associated with that program. To re-activate their account, Users must contact Universities Canada directly.
10. Challenges to compliance
Universities Canada has procedures in place to allow individuals to inquire about, or to challenge matters involving the organization’s privacy compliance. Complaints about Universities Canada’s compliance with the Universities Canada Privacy Code, PIPEDA, or this Privacy Statement, should be made by calling Universities Canada at (613) 563-1236 and speaking to the Privacy Officer or by writing to: Privacy Officer at 1710-350 Albert Street, Ottawa, Ontario K1R 1B1.