Privacy Code

OCAS, acting as an agent for Ontario’s public colleges and other postsecondary institutions, is committed to protecting your privacy and the confidentiality of your personal information, including website activity (see Terms of Use).

This Privacy Code informs you of the principles and guidelines which OCAS protects individual privacy in the course of our operations.

This Privacy Code does not apply to personal information about employees, former employees and potential employees of OCAS.

Table of Contents

10 Principles:

  1. Accountability
  2. Why We Need Your Information
  3. Obtaining Consent
  4. Limiting Collection of Personal Information
  5. Limiting Use, Disclosure and Retention of Personal Information
  6. Keeping Personal Information Accurate
  7. Safeguarding Personal Information
  8. Being Open About Policies and Procedures
  9. Providing Access to Personal Information
  10. Challenging Compliance


College(s) - any one or all of the 24 public Ontario Colleges of Applied Arts and Technology, including Institutes of Technology and Advanced Learning, regional campus of the University of Guelph and The Michener Institute of Applied Health Sciences

Personal information - information about an identifiable individual that is recorded in any form, but does not include information that is used for the purpose of communicating or facilitating communication with an individual in relation to their employment, business or profession such as the individual’s name, position name or title, work address, work telephone number, work fax number or work electronic address.

Privacy Officer - the individual OCAS has appointed to support OCAS’ compliance with this Code. The officer coordinates OCAS' response to requests for personal information.

Record - information contained in any form and includes documents, maps, drawings, photographs, letters, vouchers, papers and any other information that is written, photographed, scanned, recorded or stored in any manner, but does not include software or any mechanism that produces records.

1 - Accountability

OCAS is responsible for all personal information under its control, including personal information disclosed to third parties who provide services, such as data entry, credit card processing, or live chat. The OCAS Privacy Officer is responsible for supporting OCAS’ compliance with this Code, even though other individuals within OCAS may be responsible for the day-to-day collection and processing of personal information, and may be delegated to act on behalf of the OCAS Privacy Officer. The identity of the individual(s) designated by OCAS to oversee compliance with this Code will be made known internally and will be made available externally on request. Where OCAS acts as a processor of personal information or as a service provider to others, OCAS will comply with this Privacy Code and any Privacy Policies and / or Statements issued by the OCAS service in question in respect of the personal information it collects, uses or discloses on behalf of third parties or that is disclosed to it.

2 - Why we need your information

OCAS collects and uses information about you that includes your name, address, phone number, educational history and grades as well as information about your application and enrollment choices.

OCAS collects your personal information for the following primary purposes:

  • To identify you and provide you with service
  • To process your application and allow the colleges to which you have applied to make admission decisions

If OCAS proposes to use or disclose personal information for a purpose not previously identified, the new purpose will be identified and documented prior to the new use. Unless the new purpose is required or permitted by law, the consent of the individual will be obtained before the information can be used or disclosed for that purpose.

3 - Obtaining consent

OCAS will obtain the consent of individuals before or when it collects, uses or discloses personal information, except where authorized by law. OCAS may collect, use or disclose personal information without the knowledge or consent of individuals but only as specified and permitted by law. In obtaining consent, OCAS will use reasonable efforts to ensure that an individual is advised of the identified purposes for which personal information will be used or disclosed. Purposes will be stated in a manner that can be reasonably understood by the individual.

Generally, OCAS will seek consent to use and disclose personal information at the same time it collects the information. However, OCAS may seek consent to use and disclose personal information after it has been collected, but before it is used or disclosed for a new purpose. OCAS will require individuals to consent to the collection, use or disclosure of personal information as a condition of the supply of information or services to the individual only if such collection, use or disclosure is necessary to provide the information or services. In determining the appropriate form of consent, OCAS will take into account the sensitivity of the personal information and the reasonable expectations of individuals in relation to the purposes for use or disclosure of the information by OCAS.

An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Should an individual withdraw consent to the collection, use and disclosure of personal information, the application process or other applicable service being engaged will cease at that time. Requests to withdraw consent must be received in writing. In such case, personal information in the possession of OCAS will be expunged or rendered anonymous as appropriate and if required by law. Individuals may contact OCAS for more information regarding the implications of withdrawing consent.

4 - Limiting collection of personal information

OCAS will only collect personal information that is necessary for the purposes identified by OCAS. OCAS will collect personal information by fair and lawful means. OCAS collects personal information primarily from individuals directly and does not seek out personal or related information unless instructed by the individual or their designate/agent (e.g. following up on a transcript request). OCAS may also collect personal information from schools, school boards, post-secondary institutions that you have previously attended as well as from credential granting agencies from whom you have sought a credential evaluation. OCAS uses web analytics for purposes described in our Terms of Use.

5 - Limiting use, disclosure and retention of personal information

OCAS will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, or as required or authorized by law. Personal information will be retained only as long as necessary for the fulfillment of those purposes.

OCAS discloses your personal information to the institutions to which you have applied for the purposes described above. When you enrol in a college program, your information will become part of your college’s student record. For more information about how OCAS may disclosure your personal information, see our Privacy Policy.

OCAS has a records retention policy that specifies the length of time that records are maintained. All personal information, as minimally as required, is accessible by OCAS personnel, and / or third party service providers, who need access to that information for the performance of their duties or services.

6 - Keeping personal information accurate

OCAS will take all reasonable steps to keep personal information as accurate, complete and up-to-date as possible and necessary for the purposes for which it is to be used. OCAS aims to keep information sufficiently accurate, complete and up-to-date so as to minimize the possibility that inappropriate information may be used to make a decision about an individual. OCAS will update personal information about individuals on an on-going basis, only when necessary to fulfill the purposes identified in this Code, or upon notification by the individual.

7 - Safeguarding personal information

OCAS will protect personal information with security safeguards appropriate to the sensitivity of the information. OCAS will take all reasonable steps to protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held, using appropriate security safeguards.

In working with service providers who handle personal information on its behalf, OCAS takes reasonable steps to choose service providers that are capable of keeping personal information safe, enters into contractual agreements with service to endeavour to keep personal information safe and takes reasonable steps to administer its relationships with service providers to endeavour to keep personal information safe.

8 - Being open about policies and procedures

OCAS will make readily available to individuals specific information about OCAS policies and procedures relating to the management of personal information. OCAS will be open about its policies and procedures with respect to the management of personal information. Individuals will be able to acquire information about our policies and procedures at minimal or no cost and without unreasonable effort. This information will be made available in a form that is generally understandable.

9 - Providing access to personal information

On written request, and subject to the exemptions stipulated by law, OCAS will inform individuals of the existence, use and disclosure of their personal information and provide access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended where inaccuracies exist. In certain situations, OCAS may not be able to provide access to all of the personal information that it holds about an individual. These situations shall be limited to those required or stipulated by law. When an individual successfully challenges the accuracy or completeness of personal information, OCAS will correct, delete or add information as required. When appropriate, the amended information will be disclosed to any third parties requiring access to the information in question.

10 - Challenging compliance

An individual will be able to address a challenge concerning compliance by OCAS with this Code to the OCAS Privacy Officer. OCAS has implemented procedures to receive and respond to complaints or inquiries about its policies and procedures relating to the handling of personal information. OCAS will investigate all complaints. If a complaint is found to be justified, OCAS will take appropriate measures, including amending its policies and procedures if necessary.

Individuals will be able to obtain more information on OCAS privacy practices, or make a complaint, by contacting:

Privacy Officer
OCAS Application Services, Inc.
60 Corporate Court
Guelph, ON N1G 5J3
519.763.2363, ext. 6816

Last revised: September 2018