Prepared by : Access to Information and Privacy Committee

This Policy at a glance

HOW :

When you visit our website, download one of our mobile applications or contact us, we collect certain information about you that enables us to identify you.

WHAT :

We collect information that allows us to identify you, information about purchases and information about the use you make of our services.

WHY :

To better serve you, answer your questions, handle your requests and manage our website and applications.

Who else is involved? Suppliers that help us process payments, provide a service or communicate with you also have access to certain information.

WHERE :

Mostly in Quebec, but some of our suppliers may also have access to your information outside of Quebec.

YOUR RIGHTS :

You can request access to or the correction of your information by writing to us.

YOUR CONSENT :

You have the right to withdraw your consent at any time, but this may have an effect on the services offered.

What do we mean by « Personal Information »?

« Personal Information » is any information about an individual that makes it possible to identify them, either directly – using only this information – or indirectly – in combination with other information.

How do we collect your personal information?

We collect your personal information when you :

• Fill out one of our online forms;
• Browse on our website;
• In writing or verbally at one of our service

What information do we collect and why?

We collect only the personal information we require in order to provide our municipal services. The personal information we collect is gathered in a variety of ways, including in writing, verbally or online. This includes our computer systems, online forms and the interactivity between you and our website. We also use cookies or log files to gather information about you.

Accordingly, we may collect the following information :

1)    Information about your identity :

• Last name, first name;
• Address and postal details;
• Email address;
• Telephone or Fax numbers;
• Any other personal information required as the case may be (date of birth, SIN, resume, credit card number, ).

2)    Website usage information :

• Cookies or browsing logs;

• Online correspondence or comments;
• User behaviour analysis systems,

3)    Documents related to municipal online services :

In connection with our various online municipal services, your personal information is collected through various computer systems and forms, namely :

• Online requests;
• Access to information, claim or other service request forms;
• Registration forms (e.g. Day Camp, Emergency Information System, Online Services, Newsletter, );
• Service forms (e.g. Taxation, Water meters, );
• Subscription and access form (e.g. Library, );
• License application form, certificates of authorization or permit request;
• Rental application form;
• Financial support application form;
• Employment application form;
• Surveys,

4)    Why?

In connection with our various municipal services, we use the personal information collected for the following purposes :

• Information and service offers;
• Contacts and correspondence;
• Registration or subscription to services and contests;
• Follow-up, management and answers to requests, applications, registrations, subscriptions, licenses, certificates of authorization, permits, rentals, financial support, jobs, etc.;
• Surveys and statistics;
• Website management, service improvement, personalized welcome,

We occasionally have to use your personal information to :

• Meet our legal obligations;

• Prevent cyber threats and fraud;
  • Respond to requests, warrants and orders from courts and other agencies;
  • Protect your rights and interests as well as ours;
  • Cooperate in legal proceedings or investigations,

Who do we disclose your personal information to?

In some circumstances, we call on suppliers to help us serve you. Before disclosing your personal information with them, we take reasonable measures to ensure these suppliers undertake to comply with this Policy.

Where is your personal information stored?

We store and process your personal information in Quebec. In certain circumstances, it may be stored outside Quebec, when we use third-party service providers, mainly in Canada and the United States, but also elsewhere in the world.

Your personal information may be stored in countries other than your country of residence, which may have different privacy rules. In such cases, the information is subject to the laws of the country in which it is located, and may be disclosed to the governments, courts or law enforcement or regulatory agencies of that country.

However, at all times, our practices regarding your personal information remain governed by this Policy and by the Quebec laws applicable to the protection of personal information.

When does this Policy not apply?

This Policy does not apply to websites operated by third parties over whom we have no control. If you follow a link to a third-party site (for example, to register for an event), the privacy policy of that third party site will apply. We are not responsible for their privacy policies, procedures or practices. We encourage you to review these policies before submitting any personal information on these websites.

How long do we keep your personal information?

We keep your personal information for as long as necessary for the purposes described in this Policy, to comply with our legal obligations, to settle disputes and to enter into agreements with suppliers, when applicable.

We take reasonable steps to delete obsolete or unnecessary personal information, for example, when you tell us that you no longer wish to use our services. You may request the correction or deletion of information at any time. On this subject, please see “What are your rights?” below

How do we protect your personal information? Measures

We have implemented physical, administrative and technical measures to protect the confidentiality and security of the personal information we hold, most notably to prevent unauthorized access.

We have a plan in the event of an incident involving personal information. It stipulates that we will notify the authorities and the persons concerned when such an incident presents a risk of serious harm, and that we will put in place measures to limit negative consequences.

Limited access

Only authorized personnel who need to consult your personal information in carrying out their duties have access to it. In addition, employee accounts and access to servers and applications are subject to up-to-date security standards, including, among other things, double authentication.

Disclaimer

However, no security measure is absolute or fully guaranteed. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of any information you have provided to us has been compromised), please contact us immediately at the address listed in the “How to contact us” section below.

What are your rights?

Access, deletion and correction

You can request access the personal information we hold about you and, where applicable, request corrections as permitted or required by law. You may also request the deletion of outdated or unjustified information, or provide comments in writing.

However, to ensure that the personal information we hold about you is accurate and up-to-date, please inform us promptly of any changes.

At your request, and provided it does not entail serious practical difficulties, we can provide you with computerized personal information in a structured, commonly used technological format.

Withdrawal of your consent

You can also withdraw your consent to the use and disclosure of your personal information. However, certain services require the use of your personal information. If you

withdraw your consent, we may no longer be able to offer you these services. Some of the information we collect may not be retrievable by law (e.g. Taxation, Billing, Infraction, etc.).

To exercise your rights, please write to us at the address indicated in the “How to contact us” section below. Please note that we may ask you for identification to make sure it’s you.

To find out more about your rights under Quebec privacy laws, visit https://www.cai.gouv.qc.ca/english/.

How to contact us?

For any question or comment about this Policy or the protection of your personal information, please contact the Person in Charge of the Protection of Personal Information (PCPPI) at the following coordinates :

Person in Charge of the Protection of Personal Information (PCPPI)

   Brinda Poovadee Permal-Vardin

   Town Clerk

   Town of Hampstead

   5569 Chemin Queen Mary

   Hampstead

   H3X 1W5

   tclerk@hampstead.qc.ca

If you have reason to believe that your interaction with us is no longer secure, please contact us at : info@hampstead.qc.ca.

Our Person in Charge of the Protection of Personal Information will reply to requests for access to or correction of information and look into any complaints you may have regarding our practices with respect to your personal information.

Will this Policy be updated?

If we make significant changes to this Policy, for example, to comply with new legal requirements, we will publish a notice of change 15 days before the changes take effect. The new version, along with the notice of change, will be made available on the website, with the date of the latest update.

This Policy comes into effect on November 16, 2023.

Governance Policy regarding the Protection of Personal Information

Prepared by : Access to Information and Privacy Committee

1.  Foreword

In carrying out its activities and fulfilling its mission, Town of Hampstead handles Personal Information, in particular information regarding visitors to its website, citizens and employees. In this respect, it recognizes the importance of respecting privacy and protecting the Personal Information that it holds.

To meet its obligations in this area, the Town has prepared the present Policy. It sets forth the framework principles applicable to the protection of Personal Information held by the Town throughout the Life Cycle of the information and to the rights of the Persons Concerned.

Protecting the Personal Information held by the Town is the responsibility of any person who handles such information inherent in the performance of their duties or stemming from their relationship with the Town.

2.  Purpose

This Policy :

• sets forth the Town’s governance principles regarding Personal Information throughout its Life Cycle and the exercise of the rights of the Persons Concerned;
• provides a process for handling complaints regarding the protection of Personal Information;
• defines the roles and responsibilities relating to the protection of Personal Information at the Town;
• describes the training and awareness activities that the Town offers to its

3.  Normative Framework

This Policy has been developed in a context governed most notably by the Act respecting Access to documents held by public bodies and the Protection of personal information

(CQLR, c. A-2-1). As provided in this Act, this Policy is accessible through the Town’s website.

4.  Definitions

For the purposes of this Policy, the following terms mean :

Access Committee : the Town’s Access to Information and Privacy Committee.

CAI : the Commission d’accès à l’information du Québec.

Life Cycle : the set of steps involved in the processing of Personal Information, namely the collection, use, disclosure, retention and destruction of such information.

Privacy Impact Assessment or PIA : the preventative approach aimed at better protecting Personal Information and respecting the privacy of individuals. It consists of considering all the factors that have positive and negative impacts on the privacy of the Persons Concerned.

Confidentiality Incident : any consultation, use or disclosure unauthorized by the law of Personal Information, or any loss or other breach of the privacy of this information.

Act : the Act respecting Access to documents held by public bodies and the Protection of personal information (CQLR, c. A 2 1).

Person concerned : the individual whose Personal Information is involved.

Personal Information : any information about an individual that makes it possible to identify them, either directly using only this information or indirectly in combination with other information.

Person in Charge of Access to Documents and of the Protection of Personal Information or PCPPI : the person who, within the Town, performs this function, who responds to requests for access to documents and ensures compliance with and implementation of the Act.

Sensitive Personal Information : any Personal Information that – by its nature, in particular its medical, biometric or otherwise intimate nature, or due to how it is used or disclosed – comes with a very high reasonable expectation of privacy.

5.  Scope

This Policy applies to the Personal Information held by the Town and to any person who handles the Personal Information held by the Town.

6.  Handling of personal information

Personal information is protected throughout its Life Cycle in accordance with the following principle, except as provided by law.

6.1.  Collection

• The Town collects only the Personal Information necessary for carrying out its mission and operations. Before collecting Personal Information, the Town determines the purposes for which it will be handled.
• Personal Information is collected from the Person concerned, from a legally authorized person or, in the case of a minor under the age of 14, from the holder of parental authority or guardian.
• At the time of collection and subsequently upon request, the Town informs the Persons Concerned, in particular, of why and how their Personal Information will be used and of their rights with respect to such information, for example by referring to its Privacy Policy or by means of a notice.
• When the Act requires that consent be obtained, it must be clear, free, informed and provided for specific purposes. It is requested for each of these purposes, in simple, clear terms. This consent is valid only for as long as necessary for the purposes for which it has been requested.

6.2.  Use

• The Town uses Personal Information for the purposes for which the information has been collected. However, the Town may amend these purposes provided the Person Concerned has consented to it in advance.
• It may also use the information for secondary purposes without the consent of the Person Concerned in any of the following cases :
  • if the use is for purposes consistent with those for which the information was collected;
  • if the information is clearly used for the benefit of the Person concerned;
  • if the information is necessary for the application of an act in Quebec, whether or not the law explicitly provides for its use;
  • if the use is necessary for the purposes of study, research or producing statistics and the information has been anonymized.
• When it uses Personal Information for secondary purposes in one of the first three cases referred to in article 6.2.2, it must record the use in the register provided for the purpose, as described in article 7.3 of the Policy.
• When an act expressly requires it or when the handling of Personal Information is deemed riskier for the Persons Concerned, the Town undertakes a PIA under article 8 hereof in order to mitigate the identified risks.
• The Town prepares and keeps up-to-date an inventory of the Personal Information files it has collected, used and disclosed. At a minimum, this inventory includes :
• the classes of information it contains, the purposes for which the information is kept and the method used to manage each;
• the source of the information entered in each file;
• the categories of the Persons Concerned by the information entered in each file;
• the categories of persons who have access to each file in carrying out their duties;
• the security measures taken to ensure the protection of the Personal

• Any person who so requests has a right of access to the inventory, except with respect to information whose existence may be refused by virtue of the provisions of the Act.

6.3.  Disclosure

• Subject to the exceptions provided by law, the Town may not disclose Personal Information without the consent of the Person Concerned. The consent must be given expressly when Sensitive Personal Information is involved.
• If the Personal Information is disclosed to an agent or service provider as part of a mandate or a service agreement or to carry out a mandate, the Town indicates the measures it must take to ensure the confidentiality of the information, that it is used only in the exercise of its mandate or the performance of its contract, and that it is not retained after its expiry.
• When the Personal Information is disclosed to third parties outside Quebec, the Town shall conduct a PIA in conformance with article 8 hereof. All disclosures to third parties are entered in the register provided for the purpose.

6.4.  Retention

• The Town takes all reasonable measures to ensure that the Personal Information that it holds is up-to-date, accurate and complete to serve for the purposes for which it is collected and used.
• The Town keeps Personal Information for as long as necessary to carry out its activities, subject to the time limits specified in its retention schedule.

6.5.  Destruction and anonymization

• When the purposes for which the Personal Information was collected have been achieved, the Town takes reasonable steps to ensure that this information is destroyed or made anonymous, subject to the Archives Act (CQLR, A-21.1) and according to the time limits specified in the retention schedule and the Town’s document management rules.

7.  Registers

In accordance with the Act, the Town maintains the following registers :

• Register of disclosures of Personal Information without the consent of the Person Concerned in the following cases :
• when the Town discloses the identity of a Person Concerned to a person or a private body in order to collect information previously gathered by the person or body;
• when the Town discloses Personal Information in order to apply a Quebec act, whether or not such a disclosure is explicitly provided by law;
• when the Town discloses Personal Information in order to apply a collective agreement, decree, order, directive or regulation that establishes working conditions;
• when the Town discloses Personal Information to an agent or service provider in connection with a mandate or service agreement;
• when the Town discloses Personal Information for study, research or statistics purposes;
• when, after conducting a PIA, the Town discloses Personal Information in one of the cases referred to in section 68 of the Act.

In theses cases, the register shall include :

• the nature or type of information disclosed;
• the person or body to which the information is disclosed;
• the purpose for which the information is disclosed and, if applicable, a statement to the effect that it is a disclosure of Personal Information outside Quebec;
• the reason justifying the
  • Register of collection agreements entered into for the purpose of carrying out the functions or implementing a program of a public body with which the Town collaborates in order to deliver services or achieve a common mission. This register shall include :

• the name of the body for which the information is collected;
• the identification of the program or attribution for which the information is necessary;
• the nature or type of service to be provided or mission;
• the nature or type of information collected;
• the purpose for which the information is collected;
• the category of person within the body collecting the information and within the receiving body that has access to the information.
  • Register of uses of Personal Information within the Town for other purposes and without the consent of the Person Concerned if the use is consistent with the purposes for which it was collected, whether it is clearly for the benefit of the Person Concerned or is necessary for the application of an act in Quebec. This register shall include :

• a reference to the second paragraph of section 65.1 of the Act that allows the use, i.e. the applicable legal basis;
• in the case referred to in subparagraph 3 of the second paragraph of section

85.1 of the Act, the legislative provision that makes use of the information necessary;

• the category of person that has access to the information for the purpose
  • Register of the disclosures of information regarding a Confidentiality Incident to a person or body likely to reduce the risk of serious harm associated with a Confidentiality Incident.

This register shall include :

• a description of the Personal Information involved in the incident or, if this is not known, the reason for the inability to provide such a description;
• a short description of the circumstances of the incident;
• the date on or time period during which the incident occurred or, if this is not known, an approximation of the time period;
• the date on or time period during which the organization became aware of the incident;
• the number of Persons Concerned by the incident or, if this is not known, an approximation of the number;
• a description of the factors that lead the organization to conclude that there does or does not exist a risk of serious injury to the Persons Concerned, such as the sensitivity of the Personal Information concerned, the possible malicious

use of this information, the anticipated consequences of its use and the possibility that it be used for harmful purposes;

• if the incident presents a risk of serious injury, the dates on which notices were sent to the CAI and to the Persons Concerned, as required under the second paragraph of section 8 of the Act, as well as a statement indicating whether public notices were given by the Town and the reason why, if applicable;
• a short description of the measures taken by the organization subsequent to the incident in order to reduce the risk of injury.

8.  Privacy Impact Assessment

• The Town conducts a PIA, in particular in the following Personal Information handling situations :
• before undertaking a project to acquire, develop or overhaul an information system or electronic service delivery system that involves Personal Information;
• before collecting any Personal Information necessary for the exercise of powers, the performance of a duty and function or the updating of a program of a public body with which it collaborates to deliver services or carry out a common mission;
• before releasing Personal Information without the consent of the Persons Concerned to a person or organization that wants to use this information for study, research or statistics production purposes;
• if it intends to disclose Personal Information without the consent of the Persons Concerned, in accordance with section 68 of the Act;
• if it intends to disclose Personal Information outside Quebec or to assign to a person or organization outside Quebec the responsibility for collecting, using, disclosing or retaining such information on its behalf.
  • When conducting a PIA, the Town shall take into account the sensitivity of the Personal Information to be handled, the purposes for which it is used, its quality, its distribution and the medium involved as well as the proportionality of the measures proposed for protecting the Personal Information.
  • Moreover, if the Personal Information is disclosed outside Quebec, the Town shall ensure that it is adequately protected, in particular with respect to the generally accepted principles for the protection of Personal Information.
• A PIA is carried out to demonstrate that the Town has met all its Personal Information protection obligations and that all measures have been taken to effectively protect the information.

9.  Research Activities and Access to Personal Information

• Researchers may request access to Personal Information for research purposes. The request should be submitted to the Town’s PCPPI.
• When the PIA concludes that Personal Information may be disclosed for this purpose, the Town shall enter into an agreement with the researchers which contains the provisions required under section 2.3 of the Act and any additional measures specified in the PIA.

10.  Surveys

The following protective measures apply to Personal Information collected or used in connection with a survey, including an assessment by the Access Committee of the following :

• the need for the survey;
• the ethical aspect of the survey, taking into account, in particular, the sensitivity of the Personal Information collected and the purpose for which it is to be used;
• the rules governing the collection and retention of Personal Information from

11.  Rights of the Persons Concerned

• Subject to the provisions of the applicable laws, any Person Concerned whose Personal Information is held by the Town shall have the following rights :
• the right to access their Personal Information held by the Town and to obtain a copy of it in electronic or non-electronic Unless doing so entails serious practical difficulties, computerized Personal Information collected from a Person Concerned and not created or inferred from Personal Information about them shall be sent to them in a structured, commonly used technological format on their request;
• the right to have any incomplete or inaccurate Personal Information held by the Town corrected;
• the right to be informed, if applicable, that Personal Information is used in making a decision using automated processing.
  • Although the right to access may be exercised at any time, access to the documents containing the information is subject to certain exceptions specified in the Act.
  • Documents containing Personal Information may be viewed on site or made accessible in another manner, with or without the payment of fees. If applicable,

the Town shall inform the Person Concerned of the requirement to pay fees before their request can be processed.

• Requests to access Personal Information by the Persons Concerned may be made orally or in writing. Oral requests are handled informally and may not receive a written reply.
• Requests to access Sensitive Personal Information shall be made in writing and receive a written reply.
• Requests to access Personal Information shall be specific enough to enable the PCPPI to locate the requested information. The right of access applies only to existing Personal Information.

12.  Complaint Handling

Any complaint regarding the Town’s Personal Information protection practices or its compliance with the requirements of the Act must be submitted to the PCPPI, who shall respond to the complaint in the 20 days following its receipt.

13.  Security of Personal Information

• The Town implements reasonable security measures to ensure the privacy, integrity and availability of the Personal Information collected, used, disclosed, retained and These measures take into account the level of sensitivity of the Personal Information, the purpose for which it is collected, its quality, its location and the medium.
• The Town manages the access rights of the members of its personnel so that only those subject to a confidentiality agreement and needing to access Personal Information as part of their duties have access to it.

14. Privacy Incidents

• All Confidentiality Incidents are handled in accordance with the Town’s Confidentiality Incident Response Plan. The Town takes reasonable measures to reduce the risk of injury and prevent new incidents of a similar nature.
• Any Confidentiality Incidents are reported to the PCPPI and entered in the Register of Confidentiality Incidents, in accordance with article 7.4 of this Policy.
• If a Confidentiality Incident presents a risk of serious harm for the Persons Concerned, the Town shall promptly inform them and the CAI.

15. Roles and Responsabilities

• Protecting the Personal Information held by the Town is predicated on the commitment of all who handle such information, in particular the following :
• The PCPPI :
• ensures that Personal Information is protected throughout its Life Cycle, from collection through destruction;
• sits on the Access Committee;
• complies with the requirements related to requests for access or correction, including :
  • notifying the applicant of the date their request was received;
  • informing the applicant of the time limits and of their right of review;
  • replying to the request within 20 days or, if processing the request does not appear possible without interfering with the Town’s normal operations, within a period of 10 additional days, after having notified the applicant in writing;
  • provide assistance to the applicant in identifying the document likely to contain the sought information when their request is imprecise;
  • justify any refusal to approve a request for access;
  • at the applicant’s request, provide assistance to help them understand the resulting decision;
  • issue a decision in writing and send a copy of it to the applicant. This shall be accompanied by the text of the provision on which the refusal is based, if applicable, and a notice informing them of the procedure for review and stating the time period during which it may be exercised;
  • ensure that the information concerned by the request is kept for the time necessary to allow the applicant to exhaust the recourses provided by
• oversees the keeping of the registers listed in article 7 of this Policy;
• takes part in assessing the risk of serious harm related to a confidentiality incident, in particular as regards the sensitivity of the information concerned, the anticipated consequences of its use and the likelihood that the information will be used for malicious purposes;
• if applicable, verifies the confidentiality obligations related to the disclosure of Personal Information in connection with mandates or service agreements awarded to third-parties, in accordance with article 6.3.2 of this Policy.
• The Access Committee :
• ensures measures are implemented to raise the awareness of Town employees and management and provide training to them about the obligations and practices regarding access to information and the protection of Personal Information;
• develops the principles of information distribution;
• approves this Governance Policy Regarding the Protection of Personal Information;
• issues guidelines on the use of computerized marketing tools involving data disclosure and profiling;
• identifies the main risks involved in protecting Personal Information and informs management so that corrective measures can be proposed;
• approves any exemptions from the general Personal Information protection rules that have been established;
• issues guidelines on the protection of Personal Information, in particular regarding the retention of such information by third parties and outside Quebec;
• is consulted, from the start of a project and for the purposes of the PIA, on all projects to acquire, develop or overhaul an information system or electronic service delivery system that involves Personal Information :
  • ensuring that the PIA process is proportional to the sensitivity of the information concerned, to the purposes for which it is used, to the quantity of information, to the distribution of the information and to the medium on which it is stored;
  • when necessary, ensuring that the project allows the Person Concerned to be informed of the computerized Personal Information collected from them in a structured, commonly use technological format;
• escalates any recommendations not followed up on to the PCPPI;
• shall be informed of any Confidentiality Incident involving Personal Information and advise the Town regarding the action to take in response;
• in the event of a Confidentiality Incident, reviews the Confidentiality Incident Response Plan;
• assesses the need for a survey, the ethical aspect of the survey, taking into account, in particular, the sensitivity of the Personal Information collected and the purpose for which it is to be used, and the rules governing the collection and retention of Personal Information from surveys;
• reviews any matter of interest relating to the protection of Personal Information;
• reviews the video surveillance measures and ensures privacy is protected when such surveillance is used.
• Any person who handles Personal Information held by the Town :
• acts prudently and incorporates the principles set forth in this Policy into their activities;
• accesses only the information necessary to carry out their duties;
• incorporates and keeps information only in the files needed to carry out their duties;
• stores these files so that only authorized persons may access them;
• protects access to the Personal Information in their possession or to which they have access by using a password or otherwise;
• refrains from disclosing the Personal Information of which they become aware in the course of carrying out their duties unless duly authorized to do so;
• refrains from keeping, at the end of their tenure or contract, the Personal Information obtained or collected as part of their duties and maintains their confidentiality obligations;
• destroys any Personal Information in accordance with the Town’s destruction procedure;
• takes part in the protection of Personal Information awareness and training activities intended for them;
• flags any shortcoming, Confidentiality Incident or other situation or irregularity that could in any way compromise the security, integrity or confidentiality of Personal Information in accordance with Town’s established procedure.

16. Awareness Activities

The Town offers training and awareness-raising activities to its personnel on the protection of Personal Information. In particular, it has :

• trained its personnel and municipal council on Confidentiality Incident and best practices for protecting Personal Information;
• provided a table of good practices in the protection of Personal Information to its personnel and to the municipal council.

17. Sanctions

Any person who violates this Policy may be subject to disciplinary action, up to and including dismissal.

18. Update

In order to follow the evolution of the normative framework applicable to the protection of Personal Information and to improve the protection of Personal Information, this Policy may be updated from time to time. Please visit the Town’s Website to consult the most recent version.

19. Coming Into Effect

This Policy comes into effect on November 16, 2023.