This Privacy Code informs you of the principles and guidelines which OCAS uses to protect the personal information of individuals from whom we collect, use or disclose in the course of our operations, as subject to the provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
This Privacy Code incorporates the ten Principles of the Canadian Standards Association Model Code on the Protection of Personal Information (CAN/CSA-Q830-96) that was published in March 1996 as a National Standard of Canada. This Privacy Code does not apply to personal information about employees, former employees and potential employees (all referred to as "employees") of OCAS.
Table of Contents
- Why We Need Your Information
- Obtaining Consent
- Limiting Collection of Personal Information
- Limiting Use, Disclosure and Retention of Personal Information
- Keeping Personal Information Accurate
- Safeguarding Personal Information
- Being Open About Policies and Procedures
- Providing Access to Personal Information
- Challenging Compliance
OCAS - OCAS Application Services Inc. or Ontario College Application Services (also known as ontariocolleges.ca and ocas.ca)
PIPEDA - Personal Information Protection and Electronic Documents Act
College(s) - any one or all of the 24 public Ontario Colleges of Applied Arts and Technology, including Institutes of Technology and Advanced Learning, regional campus of the University of Guelph and The Michener Institute of Applied Health Sciences
Employees - Individuals that work at OCAS either in full-time, part-time, temporary or consultant capacities.
Personal information - information about an identifiable individual that is recorded in any form, but does not include the name, title or business address or telephone number of an employee of an organization.
Privacy Officer - Individual appointed to ensure the efficient implementation and administration of PIPEDA. The officer coordinates OCAS' response to requests made under the Act.
Record - information contained in any form and includes documents, maps, drawings, photographs, letters, vouchers, papers and any other information that is written, photographed, scanned, recorded or stored in any manner, but does not include software or any mechanism that produces records.
1 - Accountability
OCAS is responsible for all personal information under its control, including personal information disclosed to third parties who provide services, such as data entry, credit card processing, or live chat. The OCAS Privacy Officer is responsible for compliance with this Code, even though other individuals within OCAS may be responsible for the day-to-day collection and processing of personal information, and may be delegated to act on behalf of the OCAS Privacy Officer. The identity of the individual(s) designated by OCAS to oversee compliance with this Code will be made known internally and will be made available externally on request. OCAS will use contractual or other means to protect personal information that is disclosed to service providers for processing (Example: data entry). Where OCAS acts as a processor of personal information or as a service provider to others, OCAS will comply with this Privacy Code and any Privacy Policies and/or Statements issued by the OCAS service in question in respect of the personal information it collects, uses or discloses on behalf of third parties or that is disclosed to it.
2 - Why we need your information
Either before or when we collect information about you, OCAS will explain how we plan to use it. OCAS collects and uses mainly demographic and academic information. Your personal information is collected, used and disclosed for the following reasons:
- to create, process and maintain your application to college(s)
- to develop aggregate information and statistics in relation to admission-related decisions, acceptance and registration with the college(s)
- to maintain appropriate policies, programs and funding mechanisms at the colleges
- to respond to inquiries about publications, applications or college programs
- to comply with legal requirements
OCAS will require third party service providers to represent that they have complied with applicable privacy legislation. If OCAS proposes to use or disclose personal information for a purpose not previously identified, the new purpose will be identified and documented prior to the new use. Unless the new purpose is required or permitted by law, the consent of the individual will be obtained before the information can be used or disclosed for that purpose.
3 - Obtaining consent
OCAS will obtain the consent of individuals before or when it collects, uses or discloses personal information, except where authorized by law. OCAS may collect, use or disclose personal information without the knowledge or consent of individuals but only as specified and permitted by law. In obtaining consent, OCAS will use reasonable efforts to ensure that an individual is advised of the identified purposes for which personal information will be used or disclosed. Purposes will be stated in a manner that can be reasonably understood by the individual.
Generally, OCAS will seek consent to use and disclose personal information at the same time it collects the information. However, OCAS may seek consent to use and disclose personal information after it has been collected, but before it is used or disclosed for a new purpose. OCAS will require individuals to consent to the collection, use or disclosure of personal information as a condition of the supply of information or services to the individual only if such collection, use or disclosure is necessary to provide the information or services. In determining the appropriate form of consent, OCAS will take into account the sensitivity of the personal information and the reasonable expectations of individuals in relation to the purposes for use or disclosure of the information by OCAS.
An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Should an individual withdraw consent to the collection, use and disclosure of personal information, the application process or other applicable service being engaged will cease at that time. Requests to withdraw consent must be received in writing. In such case, personal information in the possession of OCAS will be expunged or rendered anonymous unless otherwise required or permitted by law. Individuals may contact OCAS for more information regarding the implications of withdrawing consent.
4 - Limiting collection of personal information
5 - Limiting use, disclosure and retention of personal information
OCAS will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, or as required or authorized by law. Personal information will be retained only as long as necessary for the fulfillment of those purposes. OCAS may disclose personal information about an individual to the following for the purposes set out in Section 2:
- Colleges and universities, and other institutions within Canada engaged in collaborative programs with member colleges, to facilitate the processing of applications and fulfillment of other requested services.
- Colleges and universities, in the case of collaborative programs, to facilitate the processing of applications and fulfillment of other requested services.
- Third party service providers for processing of information and fulfillment of other requested services.
- Ministry of Advanced Education and Skills Development or such successor government ministry or agency from time to time with jurisdiction over the Colleges and entities with which they do business, as well as the Ministry of Education, the Ministry of Agriculture, Food and Rural Affaires, the Ministry of Health, as well as other relevant or educational research agencies for funding, statistical and research purposes.
- Student information databases maintained by the college, to which the applicant eventually chooses to attend, in order to develop and maintain appropriate policies, programs and funding mechanisms.
OCAS has a records retention policy that specifies the length of time that records are maintained. All personal information, as minimally as required, is accessible by OCAS personnel, and/or third party service providers, who need access to that information for the performance of their duties or services.
6 - Keeping personal information accurate
OCAS will keep personal information as accurate, complete and up-to-date as possible and necessary for the purposes for which it is to be used. Information will be sufficiently accurate, complete and up-to-date so as to minimize the possibility that inappropriate information may be used to make a decision about an individual. OCAS will update personal information about individuals on an on-going basis, only when necessary to fulfill the purposes identified in this Code, or upon notification by the individual.
7 - Safeguarding personal information
OCAS will protect personal information with security safeguards appropriate to the sensitivity of the information. OCAS will protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held, using appropriate security safeguards. OCAS will protect personal information disclosed to third parties providing services to OCAS through contractual measures or other arrangements stipulating the confidentiality of the information, restricting the purposes for which the information is to be used and prohibiting its disclosure to third parties except upon direction from OCAS in accordance with this Privacy Code.
8 - Being open about policies and procedures
OCAS will make readily available to individuals specific information about OCAS policies and procedures relating to the management of personal information. OCAS will be open about its policies and procedures with respect to the management of personal information. Individuals will be able to acquire information about our policies and procedures at minimal or no cost and without unreasonable effort. This information will be made available in a form that is generally understandable.
9 - Providing access to personal information
On written request, and subject to the exemptions stipulated by law, OCAS will inform individuals of the existence, use and disclosure of their personal information and provide access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended where inaccuracies exist. In certain situations, OCAS may not be able to provide access to all of the personal information that it holds about an individual. These situations shall be limited to those required or stipulated by law. When an individual successfully challenges the accuracy or completeness of personal information, OCAS will correct, delete or add information as required. When appropriate, the amended information will be disclosed to any third parties requiring access to the information in question.
10 - Challenging compliance
An individual will be able to address a challenge concerning compliance by OCAS with this Code to the OCAS Privacy Officer. OCAS has implemented procedures to receive and respond to complaints or inquiries about its policies and procedures relating to the handling of personal information. OCAS will investigate all complaints. If a complaint is found to be justified, OCAS will take appropriate measures, including amending its policies and procedures if necessary.
Individuals will be able to obtain more information on OCAS privacy practices, or make a complaint, by contacting:
OCAS Application Services, Inc.
60 Corporate Court
Guelph, ON N1G 5J3
519.763.2363, ext. 6816
Individuals also have recourse to the Office of the Privacy Commissioner of Canada if they consider that OCAS has not responded satisfactorily to their complaint or inquiry.
Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Note: The Privacy Commissioner of Canada's office does not accept complaints by email as security cannot be ensured.
For a copy of the Personal Information Protection and Electronic Documents Act, please access the website of the Government of Canada at http://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html.
For copies of the CSA Model Code for the Protection of Personal Information (CAN/CSA-Q830-96; published March 1996; reaffirmed 2001), contact Consumer Measures Committee, by email: email@example.com or call 613.952.6927.
Last revised: September 2017