Developing a Privacy Policy

From Arts in Guelph- March/April, 2004

There has been much talk about privacy policies over the past few months, primarily because the full application of the federal Personal Information Protection and Electronic Document Act (PIPEDA) came into effect on January 1, 2004. What this legislation does is to extend privacy protection to personal information collected, used and disclosed in the course of any transaction that is "of commercial character."

Although, on the face of it, this definition would seem to exclude many charities and not-for-profit organizations, it is clear that what is meant by "commercial activity" is fairly broad (including selling or bartering of donor or membership lists), and is apt to become even more so as the provinces develop and enact their own legislation. In Ontario, for example, legislation was drafted in 2002, and although its introduction was delayed by an election call and change of government, its proposals go far beyond what is in the federal act. In addition, it is clear that, more and more, the public is expecting organizations to use individuals' personal information appropriately and respectfully. The average person does not distinguish between commercial and non-commercial activities.

What this, therefore, means for charities and not-for-profit organizations is that they should embark upon the development of a privacy policy that will outline how they collect, use and disclose personal information. PIPEDA defines personal information as "information about an identifiable individual." It does not include personal information consisting of name, address and telephone number that appears in a telephone directory that is available to the public, where the subscriber can refuse to have the personal information published in the directory. Business contact information is excluded from this definition.

In the process of developing a policy, organizations will need to follow several steps:

• take a close look at what personal information they collect and how do they collect it;
• why do they collect it and what do they use it for;
• where do they keep the information collected and how is it secured;
• who has access to the information and to whom is it disclosed;
• when and how is information disposed of.

It will also be helpful for organizations to review the Canadian Standards Association Model Code which is attached as Schedule 1 to PIPEDA. This code contains ten principles that should be respected if organizations are to comply even with the spirit of PIPEDA. They are:

• accountability
• identifying purpose
• consent
• limiting collection
• limiting use, disclosure and retention
• accuracy
• safeguards
• openness
• individual access
• challenging compliance

This process is not going to happen overnight. Indeed, even getting one's mind around the task is difficult, as those of us involved in guelpharts.ca / wellingtonarts.ca website have discovered. However, we have amassed a lot of materials - on file at the Guelph Arts Council office - including some sample privacy policies, and we have developed a policy that is now posted on the new website (www.guelpharts.ca). Although we must caution all that that policy is still evolving, and that we have not yet developed the policy for Guelph Arts Council's non web-based activities, we are willing to share what we have learned and the materials we have accumulated with any organizations that are struggling with privacy concepts.

For more information, contact Sally Wismer at (519) 836-3280 or gac@sentex.net.