Last updated: April 2020
Statement of Policy
It is the policy of STP ComplianceEHS (STP) to control the collection, use, and disclosure of personal information in accordance with all requirements set out in current Privacy legislation in both Canada, and the United States of America.
The following requirements shall be met by STP unless exempted by the legislation.
Collection of Personal Information
Unless otherwise authorized by the legislation:
- No personal information shall be collected by STP unless it relates directly to an operating program or activity of STP.
- STP shall, wherever possible, collect personal information that is intended to be used for an administrative purpose and software functionality purposes directly from the individual to whom it relates except where the individual authorizes otherwise.
- STP shall inform any individual from whom it collects personal information of the purpose for which the information is being collected.
Retention of Personal Information
Personal information that has been used by STP for an administrative purpose or software functionality purposes shall be retained for such a period of time after it is so used as may be prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information.
Accuracy of Personal Information
STP shall take all reasonable steps to ensure that personal information that is used for an administrative purpose and software functionality purposes is as accurate, up-to-date and complete as possible.
Disposition of Personal Information
STP shall dispose of personal information under its control in accordance with the regulations and with any directives or guidelines issued by the designated minister in relation to the disposal of that information and with its corporate retention schedule.
Use and Disclosure of Personal Information
Personal information under the control of STP shall not, without the consent of the individual to whom it relates, be used or disclosed by STP except for the purpose for which the information was obtained or compiled or for a use consistent with that purpose unless otherwise authorized by the Legislation. In certain circumstances personal information subject to the Legislation may be used, or disclosed without the knowledge or consent of the individual concerned. Such circumstances include, but are not limited to personal information used or disclosed:
- for the purpose for which the information was obtained or compiled by STP or for a use consistent with that purpose;
- for the purpose of complying with a subpoena or warrant issued or order made by a court, person or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of information;
- to an investigative body specified in the regulations for the purpose of enforcing any laws or carrying out a lawful investigation;
- to officers or employees of STP for internal audit purpose;
- to the Library and Archives of Canada and the U.S. Library of Congress for archival purposes;
- where disclosure would clearly benefit the individual to whom the information relates.
Record of Disclosures
STP shall retain a record of any use of personal information contained in a personal information bank or any use or purpose for which that information is disclosed where the use or purpose is not included in the statements of uses in the personal information index published by the designated minister and shall attach the record to the personal information.
Personal Information Banks
- STP shall include in personal information banks all personal information under its control that
– has been used, is being used or is available for use for an administrative purpose; or
– is organized or intended to be retrieved by the name of an individual or by an identifying number, symbol or other particular assigned to an individual.
Access to Personal Information
Upon receipt of a written request, STP shall provide a right of access to personal information subject to the Legislation to
- any personal information about the individual requestor contained in a personal information bank; and
- any other personal information about the individual requestor under the control of STP with respect to which the individual is able to provide sufficiently specific information on the location of the information as to render it reasonably retrievable.
Individuals who are given access to their personal information may
- request correction of the personal information where the individual believes there is an error or omission therein;
- require that a notation be attached to the information reflecting any correction requested but not made; and
- require that any person or body to whom that information has been disclosed for use for an administrative purpose within two years prior to the time a correction is requested or a notation is required under this subsection in respect of that information
- be notified of the correction or notation, and
- where the disclosure is to a government institution, the institution makes the correction or notation on any copy of the information under its control.
Refusal of Access to Personal Information
STP may refuse access to personal information as provided by the Legislation where such information, among other circumstances:
- is subject to solicitor/client privilege
- is part of or relates to an investigative record where disclosure could be injurious to the enforcement of a law of Canada or the United States of America or the conduct of investigation.
- Where disclosure threatens the safety of individuals.
All STP employees, who collect, maintain and/or use personal information, are responsible for ensuring that the collection, use and disclosure of this information is carried out in accordance with this policy and relevant procedures.
Privacy on the Internet
This privacy statement is applicable to all STP websites.
STP respects the privacy of its Internet users and will protect that privacy as vigorously as possible.
STP does not collect information that personally identifies individuals except when individuals provide such specific information on a voluntary basis. There may be occasions where specific personal information is requested before an individual can enter certain sections of a STP’s site. For example, registration is needed to enter corporate multi-user network sites. This kind of registration helps us to ensure that content standards on these sections of the site are rigorously upheld.
In all such cases, STP will collect only information that is voluntarily provided by the user and undertakes that such information will be kept strictly confidential. Individual information provided to the STP to gain access to any STP’s site will not be sold or made available to a third party.
STP does reserve the right, however, to perform statistical analyses of user behavior and characteristics, in order to measure interest in and use of the various sections of its sites so as to improve design and navigation and to gather marketing information. Only aggregated data from these analyses, not individual data, will be used for this purpose.
All questions related to the interpretation and application of this policy should be directed to the President, STP ComplianceEHS, Phone: 604-983-3434; E-mail firstname.lastname@example.org.
Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.