The legislative framework governing privacy in Canada is a patch-work and as at 2003, evolving. Specifically, Maple Leaf's operations are governed by privacy legislation in the following manner (as at December 2003).
Although PIPEDA is FEDERAL legislation, it stipulates that it will apply to both federally regulated and provincially regulated sectors (to the extent constitutionally permissible, and unless a province enacts legislation which the federal Privacy Commissioner concludes is "substantially similar" to the Federal PIPEDA legislation). In addition to PIPEDA, Alberta, British Columbia and Quebec have enacted privacy legislation. As at December 2003, only Quebec's privacy legislation has been held to be substantially similar to PIPEDA.
Personal Information regulated by privacy laws falls within 2 broad categories, being employee personal information and customer personal information. The impact of privacy legislation on each such broad category is discussed below.
As defined by PIPEDA, "Customers" refer to identifiable individuals, as opposed to business organisations with whom Maple Leaf Foods carries on business activities. Therefore, while an individual who enters a contest, responds to a survey, or lodges a complaint with a consumer response centre is a "customer", for purposes of PIPEDA, a grocery chain is not. PIPEDA governs privacy considerations that Maple Leaf Foods must comply with in dealing with customers.
|a)||a customer's name, address and telephone number, when listed in a public, professional or business directory or available through directory assistance;|
|b)||an employee's name, title, business address or business telephone number; or|
|c)||other information about the customer or employee that is publicly available and is specified by regulation pursuant to the Personal Information Protection and Electronic Documents Act.|
agent — an authorized representative or service provider acting on behalf of Maple Leaf Foods.
Maple Leaf Foods — Maple Leaf Foods Inc. and its Canadian subsidiary and affiliated companies, as they may exist from time to time (including, without limitation, Canada Bread Company, Limited ) as well as employees and agents acting on behalf of Maple Leaf Foods.
collection — the act of gathering, acquiring, recording, or obtaining personal information from any source, including third parties, by any lawful means.
consent — voluntary agreement with the collection, use and disclosure of personal information for defined purposes. Consent can be either expressed or implied and can be provided directly by the individual, by his or her legal guardian or by a person having power of attorney for the individual.
customer — an individual who (a) utilises, or applies to utilise, the products or services of Maple Leaf Foods; or (b) corresponds with Maple Leaf Foods; or (c) enters a contest or other promotional activity sponsored by Maple Leaf Foods.
disclosure — making personal information available to a third party.
employee — a current or former employee or pensioner of Maple Leaf Foods including full time, part time and contract employees.
personal information — information about an identifiable customer or an employee, but does not include aggregate information that cannot be associated with a specific individual.
third party — an individual other than the subject customer, employee or his or her respective agent or an organization other than Maple Leaf Foods.
use — the treatment, handling, and management of personal information by and within Maple Leaf Foods, or any party to whom Maple Leaf Foods has contracted out certain business functions, or who provides business services to, or on behalf of Maple Leaf Foods.
To the extent required by applicable legislation, principles governing Maple Leaf's privacy obligations are set out in detail as follows:
Principle 1 — Accountability
Maple Leaf Foods is responsible for personal information under its control and shall designate one or more persons who are accountable for Maple Leaf Foods' compliance with the following principles.
|1.3||Maple Leaf Foods is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing, or other contracted services. Maple Leaf Foods shall utilise appropriate means to provide a comparable level of protection while information is being processed, or used in conjunction with delivery of contracted services by a service provider (see Principle 7).|
|2.1(a)|| Maple Leaf Foods collects personal information for the following commercial purposes:
|2.1(b)|| We collect, use and disclose employee personal information to establish, manage terminate and administer the employee relationship;
|For additional purposes for which Maple Leaf Foods may use or disclose personal information, please see Principle 5. Further references to "identified purposes" mean the purposes identified in this Principle and in Principle 5.|
|2.2||Maple Leaf Foods shall specify orally, electronically or in writing the identified purposes to the customer or employee at the time or before personal information is collected. Upon request, persons collecting personal information shall explain these identified purposes or refer the individual to a designated person within Maple Leaf Foods who shall explain the identified purposes.|
|2.3||Unless allowed by law Maple Leaf Foods shall not use or disclose for any new purpose personal information that has been collected without first identifying and documenting the new purpose and obtaining the consent of the customer or, where required by law, the employee.|
|2.4||In addition to identification of purposes for which personal information is collected, in Quebec, the source of the personal information must be identified where personal information is collected from a third party.|
|3.1||Maple Leaf Foods may use or disclose personal information without knowledge or consent in the case of an emergency where the life, health or security of an individual is threatened or reasonably perceived to be threatened. Maple Leaf Foods may also disclose personal information without knowledge or consent to a lawyer representing Maple Leaf Foods, to collect a debt, in investigations of breaches of laws, (and in the case of disclosure, there are reasonable grounds to believe the personal information relates to a breach of laws or agreements) to comply with a subpoena, warrant or other court order, or as may be otherwise required or authorized by law, or for statistical, scholarly or research related matters. To the extent that applicable privacy legislation, does not apply to Maple Leaf employees, or impose an obligation to obtain consent, Maple Leaf may collect, use, or disclose personal information without employee consent.|
|3.2||In obtaining consent, where required by applicable privacy law, Maple Leaf Foods shall advise customers or employees of the purposes for which personal information will be used or disclosed. Purposes shall be stated in a manner that can be reasonably understood by the customer or employee.|
|3.3||Generally, Maple Leaf Foods shall seek consent where required by law to use and disclose personal information at the same time it collects the information. However, Maple Leaf Foods may seek consent to use and disclose personal information after it has been collected, but before it is used or disclosed for a new purpose.|
|3.4||Maple Leaf Foods will not, as a condition of the supply of a product or service, require customers or employees to consent to the collection, use or disclosure of personal information beyond that required to fulfil the identified purposes.|
|3.5||Where consent is required by law, in determining the appropriate form of consent, Maple Leaf Foods shall take into account the sensitivity of the personal information|
|3.6||In general, unless otherwise specified by a customer or employee, i) a customer's utilisation of Maple Leaf Foods' products and services, correspondence with Maple Leaf Foods or participation in a contest or other promotional activity sponsored by Maple Leaf Foods or ii) an employee's acceptance of and continued employment or benefits, constitutes consent for Maple Leaf Foods to collect, use and disclose personal information for all identified purposes.|
|3.7||A customer or employee, may withdraw its consent, where such consent is required by law, at any time, subject to legal or contractual restrictions and reasonable notice. Customers and employees may contact Maple Leaf Foods for more information regarding the implications of withdrawing consent.|
|4.1||Maple Leaf Foods primarily collects personal information directly from its customers or employees.|
|4.2||Maple Leaf Foods may also collect personal information from other sources including credit bureaus, employers or personal references, or other third parties who represent that they have the right to disclose the information.|
|5.1||In certain circumstances personal information can be collected, used or disclosed without the knowledge or consent of the individual. (See Principle 3.1)|
|5.2|| In addition to the other identified purposes in Principles 2.1 and 5.3, Maple Leaf Foods may disclose a customer's personal information to:
|5.3|| In addition to the other identified purposes in Principles 2.1 and 5.2, Maple Leaf Foods may disclose personal information about its employees or former employees:
|5.4||Only Maple Leaf Foods employees with a business need to know, or whose duties reasonably so require, are granted access to personal information about customers and employees.|
|5.5||Maple Leaf Foods shall keep personal information only as long as it remains necessary or relevant for proper retention procedures and the identified purposes or as required by law. Depending on the circumstances, where personal information has been used to make a decision about a customer or employee, Maple Leaf Foods shall retain, for a period of time that is reasonably sufficient to allow for access by the customer or employee, either the actual information, or the rationale for making the decision.|
|5.6||Maple Leaf Foods shall maintain reasonable guideline procedures for information and record retention and destruction, which apply to personal information that is no longer necessary or relevant for the identified purposes or required by law to be retained. Such information shall be destroyed, erased or made anonymous.|
|6.1||Personal information used by Maple Leaf Foods shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about a customer or employee.|
|6.2||Maple Leaf Foods shall update personal information about customers and employees as and when necessary to fulfil the identified purposes or upon notification by the individual.|
|7.1||Maple Leaf Foods shall utilise commercially reasonable efforts to protect personal information against such risks as loss or theft, unauthorized access, disclosure, copying, use, modification or destruction, through appropriate security measures. Maple Leaf Foods shall protect the information regardless of the format in which it is held.|
|7.2||Maple Leaf Foods shall protect personal information disclosed to third parties, including service providers, by contractual agreements stipulating the confidentiality of the information and the purposes for which it is to be used.|
|7.3||All of Maple Leaf Foods' employees with access to personal information shall be required to respect the confidentiality of that information.|
|7.4||In Quebec, when collecting personal information an individual must be advised where that file will be kept, and the individual's rights of access and rectification, who has access to it, the use and object of the file.|
|8.1|| Maple Leaf Foods shall make information about its policies and practices easy to understand, including:
|9.1||Upon written request, Maple Leaf Foods shall afford customers and employees a reasonable opportunity to review the personal information gathered by Maple Leaf Foods. Personal information shall be provided in understandable form within a reasonable time, and at a minimal or no cost to the individual.|
|9.2||Upon written request Maple Leaf Foods shall provide an account of the use and disclosure of personal information and, where reasonably possible, shall state the source of the information. In providing an account of disclosure, Maple Leaf Foods shall provide a list of organizations to which it may have disclosed personal information about the individual when it is not possible to provide an actual list.|
|9.3||In order to safeguard personal information, a customer or employee may be required to provide sufficient identification information to permit Maple Leaf Foods to account for the existence, use and disclosure of personal information and to authorize access to the individual's file. Any such information shall be used only for this purpose.|
|9.4||Maple Leaf Foods shall promptly correct or complete any personal information concluded to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness shall be noted in the individual's file. Where appropriate, Maple Leaf Foods shall transmit to third parties having access to the personal information in question any amended information or the existence of any unresolved differences.|
|9.5||Customers can obtain their personal information or seek access to their individual files by contacting a customer service representative or the Maple Leaf Foods Privacy Officer.|
|9.6||Employees can obtain access to their personal information or seek access to their personnel files by contacting their manager or Human Resources.|
|10.1||Maple Leaf Foods shall maintain procedures for addressing and responding to all inquiries or complaints from its customers and employees about Maple Leaf Foods handling of personal information. Maple Leaf Foods shall inform its customers and employees who make inquiries or lodge complaints about the existence of these procedures as well as the availability of complaint procedures.|
|10.2||Maple Leaf Foods' Privacy Officer shall inform any individual who has made a request pursuant to this principle, where such request is refused, in writing of such refusal, setting out his/her reasons for such refusal, as well as the availability of complaint procedures.|
|10.3||Maple Leaf Foods' Privacy Officer may seek external or internal advice where appropriate before providing a final response to individual complaints.|
|(i)|| by mail at:
Maple Leaf Foods Inc.
|(ii)||by e-mail at: MillerJS@MapleLeaf.ca|
|(iii)||by phone at (416) 926-2011; or|
|(iv)||by fax at (416) 963-6125|
Additional Procedures for the Use, Collection and Disclosure of Personal Information in Quebec
In Quebec, the following additional guidelines must be followed when collecting/recording personal information:
|(i)||consent must be explicit, regardless of the sensitivity of the personal information;|
|(ii)||information pertaining to the health and lifestyle of individuals must be collected on a form that can be separated from the rest of the application;|
|(iii)||the first time personal information is collected, individuals are to be informed that the personal information will be recorded in a file that has been established for them, the purpose/object of the file, the use which will be made of it, the categories of persons who will have access to it, the place where it will be kept and the individual's right of access to the personal information, and rectification;|
|(iv)||unless the Company has specific consent to combine the personal information, and depending on the sensitivity of the issues, separate files must be established for the same individual if there are multiple purposes/objects for the personal information on record about the individual (e.g. separate files for different policies; separate files for different employment issues).|