COVID-19 and Privacy
The COVID-19 outbreak is raising questions about privacy issues during a pandemic. During a public health crisis, privacy laws still apply, but they are not a barrier to appropriate information sharing.
PIPEDA allows organizations to collect, use or disclose information only for purposes that a reasonable person would consider appropriate in the circumstances (subsection 5(3)).
Organizations are required to obtain the knowledge and meaningful consent of the individual for the collection, use, or disclosure of their personal information (Principle 3). Consent is only valid if it is reasonable to expect that the individual understands the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting (section 6.1).
This said, there are some circumstances under which organizations may collect, use, or disclose personal information without the consent of the individual, including:
- If the collection and use is for the purpose of making a disclosure required by law (paragraphs 7(1)(e), 7(2)(d) and 7(3)(i)). For instance, this would include where a public health authority has the legislative authority to require the disclosure.
- If the disclosure is requested by a government institution under a lawful authority to obtain the information and the disclosure is for the purpose of enforcing or administering any law of Canada or a province (subparagraphs 7(3)(c.1)(ii)-(iii)). Again, this would include instances where a public health authority has the legislative authority to require the disclosure.
- If the disclosure is made on the initiative of the organization to a government institution, which has reasonable grounds to believe that the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed (paragraph 7(3)(d)(i)). This would include if an organization believes an individual is in contravention of an invoked quarantine order.
- If the use or disclosure is for the purpose of acting in respect of an emergency that threatens the life, health or security of an individual (paragraphs 7(2)(b) and 7(3)(e)), such as if an individual requires urgent medical attention, and they are unable to communicate directly with medical professionals.
The YMCA is committed to protecting the privacy of the personal information of its participants, members, donors, parents/guardians, staff, volunteers and independent contractors. We value the trust of those we deal with, and the public, and recognize that maintaining this trust requires that we be accountable in how we treat the information that is shared with us. During the course of our various projects and activities, we frequently gather and use personal information. Anyone from whom we collect information should expect that it will be carefully protected and that any use of or other dealing with this information is subject to consent. Our privacy practices are designed to achieve this. The YMCA shall indicate either verbally, electronically or in writing, at or before the time personal information is collected, the purpose for which it is being collected.
Defining Personal Information
Personal information is any information that can be used to distinguish, identify, or contact a specific individual. This information can include an individual’s opinions and beliefs, as well as facts about, or related to, the individual. Exceptions: business contact information, and certain publicly available information, such as names, addresses and telephone numbers as published in telephone directories, are not considered personal information.
Where an individual uses his or her home contact information as business contact information as well, we consider that the contact information provided is business contact information, and is not therefore subject to protection as personal information.
Personal information gathered by our organization is kept in confidence. Our personnel are authorized to access personal information based only on their need to deal with the information for the reason(s) for which it was obtained. Safeguards are in place to ensure that the information is not disclosed or shared more widely than is necessary to achieve the purpose for which it was gathered. We also take measures to ensure the integrity of this information is maintained and to prevent its being lost or destroyed.
The knowledge and consent of an individual is required for the collection, use or disclosure of personal information, except where not required by law.
For children under 12 years of age, we obtain permission from a parent or legal guardian to collect and use personally identifiable information about a child.
We regularly review our privacy practices for our various activities, and update our policy. Please check our website on an on-going basis for information on our most up-to-date practices. Further information on privacy and your rights in regard to your personal information may be found on the website of the Privacy Commissioner of Canada at: www.privcom.gc.ca.
The contact information of the Privacy Officer for the YMCA is provided below:
Vice President of People & Culture
123 Aylmer St. S., Peterborough, ON K9J 3H8