Preamble

As image bearers, we recognize that we are uniquely created with gifts and skills. Each person has a mandate to do their part in cultivating the earth and exercising dominion over it in a stewardly way. Our roles and responsibilities do define us to a certain degree. They contribute to who we are as persons. Whether we are students, employees or volunteers, we should treat one another with respect. This respect includes how we collect and manage personal information of others.

The Personal Information Protection and Electronic Documents Act (“PIPEDA”) is federal privacy legislation that also applies to the collection, use and disclosure of personal information by private sector organizations in Ontario in the course of commercial activities. Most activities of independent schools in Ontario that operate as charities are not subject to PIPEDA; however, activities that are outside of the core activity of providing educational services may be subject to PIPEDA. In this regard, a school may want to seek legal advice in regard to: (1) whether a particular activity in which it is engaged or wants to engage is likely to be subject to PIPEDA (or other privacy legislation); and (2) implementing privacy policies and practices.

Even if privacy law does not apply to the activities of independent schools, there are good reasons to apply privacy principles (principles of fair information practice) to personal information. Ontario courts have recognized a tort of invasion of privacy, which provides individuals with privacy rights outside of those granted under PIPEDA.¹ The privacy principles set out in Schedule 1 to PIPEDA may be used by schools as a framework for the collection, use and disclosure of personal information of students, parents and alumni. Unity Christian High School seeks to meet the highest standards possible and to comply, where possible, with applicable provisions relevant to public schools with respects to privacy legislation and any other applicable legislation.

This privacy policy applies to personal information of students, parents, staff, volunteers, and alumni of the school.

This policy stands alongside the Media Consent Policy, the Media Presence Policy and the Ontario Student Records Policy.

Definitions

Personal information is the recorded information about an identifiable individual in any format, including but not limited to:

1. information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual;
2. information relating to the education, medical, psychiatric, psychological, criminal or employment history of the individual, including job performance, or information relating to financial transactions in which the individual has been involved, including income and claims;
3. any identifying number, symbol or other particular assigned to the individual;
4. the address, telephone number, fingerprints or blood type of the individual;
5. the personal opinions or views of the individual except if they relate to another individual;
6. correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence;
7. information about physical appearance, lifestyle, leisure activities, academic records, relationships, marital history, immigration status, travel or movement detail, legal proceedings, career history, insurance policy and claims;
8. the views or opinions or another individual about the individual; and
9. the individual’s name as it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

Informed Consent requires the person consenting to understand the nature of the information for which consent is sought, understand the potential consequences of signing the consent form, and be given the right to revoke the consent at any time.

Before disclosing a record, the School shall provide notice to any person to whom the information in the record relates if it is practicable to do so:

1. written notice to the applicant to respond to a Municipal Freedom of Information and Protection of Privacy Act request for information;
2. written notice to the applicant and to any person to whom the information in the record relates to the decision to disclosure or refusal to disclose, including appeal procedures; and;
3. written notice regarding the legal authority for the collection, the principal purpose or purposes for which the personal information is intended to be used, and a contact individual who can answer questions regarding the collection.

Retention time is the minimum amount of time to keep a record as determined to be necessary by law or other authority. Original records cannot be destroyed until the retention time has expired. Likewise, records should not be retained longer than the retention time without good reason.

Disclosure means to make the information available or release it to another institution or person but does not include using the information.

Access means the authority or permission to consult records or to obtain restricted information.

Security means the protection of personal information, regardless of the format in which it is held, and includes, but is not limited to, physical measures such as locked filing cabinets and restricted offices, organizational measures such as limited access, and technological measures such as the use of passwords and encryption.

Collection means to gather, acquire, receive, or obtain the information by means from any source.

Policy

Unity Christian High School (the “School”) values its relationship with its students, their parents, alumni, staff and volunteers (collectively, “School Individual”) and is committed to the protection of their personal information.

The School applies the privacy principles set out in this Privacy Policy (the “Policy”) when collecting, using and disclosing personal information of a School Individual. Any use or disclosure of personal information that is not addressed in this Policy (e.g., in connection with a specific program or service, will be described in other documentation). The privacy principles that are the foundation of this Policy are based on the principles in Schedule 1 of the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”).

Accountability

The Principal of the School has been appointed as the Chief Privacy Officer assigned to oversee the implementation of this Policy.

Accountability for compliance with this Policy rests with the School’s Chief Privacy Officer or designate, even though others within the School may have responsibility for the day-to-day collection and processing of personal information and may be delegated to act on behalf of the Chief Privacy Officer.

The Principal may designate various individuals with responsibilities relative to maintaining and storing personal information. For example:

1. The Administrative Assistant is assigned to the Ontario Student Records (OSR) and parent and membership records.
2. The Bookkeeper is assigned to the payroll records, tuition files and other financial information.

The School is responsible for personal information in its custody and under its control, including personal information that it has transferred to an external service provider for processing. Where the School uses external service providers that require access to personal information (e.g., to maintain its computer system or to assist with clerical or administrative activities), it requires the service providers to provide personal information protection at a comparable level to that provided by the School.

Identifying Purposes

The School will identify and document the purposes for which it collects, uses, or discloses personal information at or before the time of collection. The purposes will be limited to those that are related to the School’s business and activities including:

1.For Students, Parents & Alumni

• to process applications and open and maintain a student file;
• to maintain a record of a student’s course of study, evaluations, academic and other achievements;
• to process or facilitate scholarships, grants and like awards;
• to provide information to other academic institutions (e.g., example colleges and universities);
• to communicate with students and parents about matters related to the student’s attendance, evaluation, course of study, and School activities and events;
• to maintain contact with and notify alumni of activities, events, services, and other matters relating to the School;
• in connection with fundraising initiatives;
• for billing and processing of fees and donations;
• to communicate with designated contacts about and to manage emergencies;
• to obtain insurance and file insurance claims;
• in connection with a sale or other transaction or reorganization of the School’s operations;
• to comply with legal requirements and co-operate with law enforcement activities.

2.For Staff & Volunteers

• to recruit, process applications, evaluate an applicant’s suitability for employment or volunteer position, hire/retain individuals and monitor vacancies;
• to establish, maintain, and terminate records of the employment/volunteer relationship;
• to administer payroll, expenses, benefits, and provide services;
• to comply with statutory requirements including those related to taxation;
• to communicate or publicize information about School business, events and services;
• to monitor and appraise performance;
• to provide development and training activities;
• to monitor time and attendance (absence control) and leaves of absence;
• to administer health and safety requirements;
• to apply for grants, and in connection with other funding opportunities;

3.For All School Individuals

• to communicate with the individual’s designated contact in an emergency;
• to comply with legal requirements and co-operate with law enforcement activities;
• to obtain insurance and file insurance claims;
• in connection with a sale or like transaction or a reorganization of the School’s operations.

If the School plans to use personal information it has collected for a purpose not previously identified, the School will identify the purpose and obtain consent to the use unless using the information without consent is permitted or required by law.

Consent

The School only collects, uses, or discloses personal information with the knowledge and consent of the individual to whom it relates (or their parent or guardian), except where otherwise permitted or required by law.

The way in which the School seeks consent varies depending upon the sensitivity of the personal information, the reasonable expectations of the individual to whom it relates (and in the case of students, their parents) and the purpose for which the personal information is to be used.

Consent may be withdrawn, subject to legal restrictions and reasonable notice; however, the withdrawal (or refusal) of consent to use or disclose personal information may restrict or prevent participation in programs or the receipt of certain services. The School will provide notice where there will be implications to withdrawing consent.

The School will not, as a condition of employment or volunteering, require an employee or volunteer to consent to the collection, use, or disclosure of personal information beyond that required for those purposes.

The School may hire service providers to perform services on its behalf. The School provides them with a limited amount of information which is necessary in order for them to provide the services required. They are prohibited from using the information for purposes other than to facilitate and carry out the services they have been engaged to provide and are not permitted to disclose this information to others. The School will strive to protect personal information disclosed to third parties by contractual agreements requiring that those third parties adhere to confidentiality and security procedures and protections.

In some cases, personal information that the school manages may be transferred, processed and stored outside Canada, and therefore may be available to government authorities under lawful orders and laws applicable therein.

Limiting Collection

The School will collect, use and disclose personal information for the purposes identified above, for purposes identified outside of this Policy, or where otherwise permitted or required by law.

Limiting Use, Disclosure and Retention

The School will not use or disclose personal information for purposes other than those for which it was collected, except with consent or as permitted or required by law.

The School retains personal information for as long as required to fulfill the identified purposes or to comply with statutory retention periods.

Personal information that has been used by the School to make a decision about an employee or volunteer will be retained for at least one year after the decision has been made.

The School destroys or makes anonymous personal information that it no longer needs for the identified purposes or legal requirements.

Accuracy

The School will use its best efforts to ensure that personal information is as accurate and complete as is necessary for the purposes for which the information is to be used. The School asks students, parents, and alumni to update personal information they have provided to the School as it changes. It asks employees and volunteers to correct out-dated personal information, such as residential addresses and other contact information.

If an employee or volunteer demonstrates to the School that their personal information is inaccurate or incomplete, the School will correct or complete the Personal Information. Requests for correction should be made to the Chief Privacy Officer.

Safeguards

To protect personal information against loss, theft, and unauthorized access, disclosure, use, and modification, the School has implemented safeguards such as:

1. physical measures, such as locked offices and other areas of the facilities;
2. organizational measures, such as security clearances, permitting access on a “need to know” basis only, requiring external service providers that need access to personal information to use safeguards that provide a comparable level of protection to that provided to personal information by the School and enforcing such requirements; and
3. technological measures, such as the use of passwords to access the School’s computer system and security firewalls, etc.

The School requires compliance by its employees with this Policy, enforces that requirement, and exercises care in the disposal of personal information to prevent unauthorized access.

Openness

Through this Policy, the School makes available a general account of its personal information management practices, including the purposes for which it uses and discloses personal information, instructions on how to gain access to and correct personal information and how to obtain additional information about the School’s privacy practices and/or its use and disclosure of particular personal information.

Access, Correction, Inquiries

Upon written request, the School will provide an individual with information about its use and disclosure of personal information (and, if applicable, their child’s personal information), and except in limited circumstances, will give the individual access to personal information.

Except in limited circumstances, including where doing so would reveal personal information about another individual, the employee or volunteer will be permitted to review their own personal information in the presence of a designated employee of the School.

The School will correct or complete personal information, on the written request of an individual, where it is satisfied the information is inaccurate or incomplete.

Individuals are invited to direct any requests for access or correction and any questions they may have about this Policy, the School’s privacy practices, or the School’s management of their personal information to the Chief Privacy Officer (or designate) whose contact information is provided below.

The School will respond to written requests for correction or access as promptly as possible. The School may ask for additional information it needs to process a request and/or to verify identity and ensure that it does not disclose personal information to someone who is not authorized to receive it or otherwise in violation of this Policy.

Compliance

As previously mentioned, any School individual is invited to bring any concerns or questions concerning the School’s compliance with this Policy or personal information management to the Chief Privacy Officer or designate, who can be reached at:

Chief Privacy Officer: Pamela Running

Contact Information:

1 Other examples of privacy legislation which may apply include: the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), the Personal Health Information Protection Act (PHIPA) and the Education Act as it applies to the OSR guidelines.