Policy Statement

The Canadian Association of Internes and Residents (CAIR) is committed to protecting the privacy of our members and non-members and the security of their personal information under our control.

The federal Parliament has passed the Personal Information Protection and Electronic Documents Act (PIPEDA), which sets out ten privacy principles that apply to all Canadian organizations engaged in commercial activities. We will, on a voluntary basis, endeavour to comply with these ten privacy principles. If, in the future, CAIR becomes engaged in a commercial activity, then CAIR must comply with these ten privacy principles for that activity.

This policy describes how CAIR collects, uses and discloses personal information. In some provinces, separate provincial privacy legislation imposes obligations on not-for-profit organizations.

CAIR reviews this policy from time to time to ensure that it is relevant and remains current with changing laws and regulations. This policy is current as of the "Last revised" date set out above.

Definitions and Privacy Principles

"Personal information" includes all information about an identifiable individual, but does not include the name, title, business address or business telephone number of an employee of an organization.

"Commercial activity" means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.

In our effort to protect the privacy of our members and non-members, we observe the following ten privacy principles:

1. Accountability: An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.
2. Identifying Purposes: The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.
3. Consent: The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
4. Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.
5. Limiting Use, Disclosure and Retention: Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.
6. Accuracy: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
7. Safeguards: Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
8. Openness: An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
9. Individual Access: Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
10. Challenging Compliance: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization's compliance.

Privacy Policy

1. Accountability
CAIR collects, uses and discloses personal information in accordance with current privacy legislation and this policy. CAIR's Privacy Officer is accountable for compliance with this policy.

CAIR staff is educated and reminded about this policy and the appropriate management of personal information.

2. Identifying Purposes
CAIR identifies the purposes for which personal information is collected from members and non-members at or before the time of collection.

CAIR ensures that members and non-members understand the reasons for collection and use of their personal information.

If CAIR wishes to use personal information that it has collected for a purpose not previously identified, CAIR identifies the new purpose and obtains the consent of members or non-members to use their information for that purpose, prior to use, unless the law requires the new purpose.

CAIR collects personal information to communicate with members and non-members about matters of interest to residents, and for the following purposes:

• Membership applications
• Membership maintenance and updates
• Payment of annual dues online
• Website visits (see Website below)

3. Consent
CAIR obtains consent from members and non-members for the collection, use or disclosure of their personal information. Either written or oral consent is obtained for collecting, using and disclosing personal information. Implied consent is permitted for the ongoing use of personal information, consistent with the purposes for which it was collected.

CAIR advises members and non-members that they may withdraw their consent to the use of their personal information at any time by notifying CAIR's Privacy Officer, subject to legal or contractual restrictions and reasonable notice. CAIR informs members and non-members of the implications of such withdrawal.

Members and non-members may instruct CAIR not to disclose their names, addresses and other personal information to other organizations for the identified purposes.

4. Limiting Collection
CAIR collects only as much personal information as is required to provide its services to members and non-members.

5. Limiting Use, Disclosure and Retention
CAIR does not use or disclose personal information for purposes other than those for which it was collected, except with the consent of a member or non-member or as required by law.

Website Use

When Exiting the CAIR Website
The CAIR website contains links to other sites. Once visitors link to another site, they are subject to the privacy policy of the new site. CAIR encourages its visitors to read the privacy policies of all websites visited, especially if personal information is shared.

Retention

CAIR retains personal information only as long as necessary for the fulfillment of the identified purposes. CAIR destroys, erases or makes anonymous personal information that is no longer required to fulfill the identified purposes.

6. Accuracy
CAIR updates personal information as required.

7. Safeguards
CAIR takes reasonable measures to ensure that personal information is kept safe from loss or theft, unauthorized access, use, copying, disclosure or modification. The measures CAIR takes to ensure the security of personal information include:

• Physical security of our premises
• Restriction of staff access to files on a "need to know" basis
• Fireproof and locked file cabinets
• Undertakings by all staff to comply with our policy
• Deployment of technological safeguards like security software, encryption and firewalls to prevent hacking or unauthorized computer access
• Internal password and security policies
• Regular audits of our procedures and measures to ensure that they are properly administered and that they remain effective and appropriate.

CAIR disposes of personal information with care to prevent unauthorized parties from gaining access to the information.

8. Openness
This policy is available to members and non-members whose personal information is collected by CAIR. This policy can be obtained by visiting the CAIR website (www.cair.ca) or contacting CAIR's Privacy Officer.

9. Access
CAIR will, upon request, give members and non-members information about the existence, use and disclosure of their personal information.

Members whose personal information has been collected by CAIR may access their own information in the "Member Profile" of the "Members Only" area on the CAIR website.

Members and non-members may challenge the accuracy and completeness of their personal information and notify the CAIR Office if any changes are required.

10. Challenging Compliance
CAIR complies with applicable privacy legislation related to the management of personal information. Any questions or complaints about CAIR's management of this information should be directed to CAIR's Privacy Officer:

Privacy Officer
Canadian Association of Internes and Residents
151 Slater Street, Suite 412
Ottawa, ON K1P 5H3
Phone: 613-234-6448
Fax: 613-234-5292
privacy@cair.ca