Privacy Policies (Students and Staff)
Privacy Policy
Ensuring and maintaining the privacy of students and staff is of the utmost importance to Springfield College. The following is the Privacy Policy (for students and staff) applicable to all Springfield College campuses in order to meet applicable provincial requirements. This policy is to be included in the Campus Student Handbook and Employee Handbook, respectively. The Privacy Policy requires a person, usually, the Campus Director, to be designated as a Privacy Officer.
Definitions
Personal information is personally identifiable information, such as your name, address, e-mail address, Social Insurance identification, birth date, and gender. Personal information is collected when a person chooses to provide it when enrolling for training, requesting information from Springfield College about training, or attending Springfield College to obtain information. Similarly personal information is collected when a person chooses to apply for or attains employment with Springfield College. Business contact information such as the name, title, business address, e-mail address or telephone number of a business or professional persona or an employee of an organization is not considered personal information.
Non-personal information is information of an anonymous nature, such as aggregate information, including demographic statistics.
Use of Personal Information
Personal information may be used by Springfield College for the following purposes:
- To manage and administer the delivery of training and relevant services to Springfield College students;
- To maintain the accuracy of our records, in accordance with legal, regulatory and contractual requirements;
- To contact consumers about training and relevant services that are available from Springfield College; and
- To perform statistical analyses of the collective characteristics and behavior of Springfield College students, in order to monitor and improve our operations and to maintain the quality of our products and services.
- Some provincial/territorial regulators may require that a specific Use of Personal Information Form be signed by students in order to release their information for statistics research across Jurisdiction.
Disclosure of Personal Information
Springfield College will not sell or rent personal information to third parties. This Privacy Policy Statement is subject to the Personal Information Protection and Electronic Documents Act and/or other relevant applicable privacy legislation and regulations, as well as the Private Career Colleges Act and any policy directives issued from time to time by the Superintendent of Private Career Colleges.
Springfield College will only disclose a person’s personal information to third parties:
- Where the person has specifically given consent to disclose certain personal information for a designated purpose;
- Who are acting on our behalf, as our agents, suppliers or service providers, solely to enable us to more efficiently provide the person with the training and other services that the person has requested;
- To facilitate the provision of training and services that the person has requested; or
- As required by law, including by any order of any court, institution or body with authority to compel the production of information.
Access to Personal Information
For access to their own personal information, a person should contact the Springfield College Privacy Officer (usually the Campus Director at a Springfield College Campus). A request should be made in writing and should include sufficient identifying information so that the Privacy Officer can expeditiously locate the personal information requested.
Treatments of Books and Equipment
If you have questions or comments about this Privacy Policy or any other Springfield College privacy practice that were not answered here, please contact our designated Privacy Officer at 1-647-872-4464.
For questions or comments to the Ministry of Colleges, Universities, Research Excellence and Security, please send notification to: Graham Webster, Manager OSAP Inspection and Compliance Unit, graham.webster@ontario.ca. Telephone: (416) 557-9033.
Privacy Breach Process and Procedures for College Campus
What is a Privacy Breach?
A privacy breach occurs when there is unauthorized access to personal information. Examples include misdirected mail and/or email, access to a personal computer, a stolen computer or student file, and loan documents misdirected to another college.
Responding to a Privacy Breach
The most important step to take is to respond to a privacy breach as soon as it occurs. The subsequent steps should be exercised immediately following the breach.
- Contain the Breach. It is important to assess and contain the breach by stopping the practice, recovering the material, and correcting the flaw in the security. Ensure that no copies of the personal information have been made or retained by an unauthorized recipient of the information. Also obtain the contact information of the unauthorized recipient in case of the need for follow-up.
- Evaluate the Risks Associated with the Breach. What type of personal information was breached? Can it be used for harmful or unethical purposes? What was the extent of the breach? Who and how many individuals are affected by the breach?
- Notification of the Breach. Notification of the breach to the individual(s) is important to avoid or reduce harm to the individual whose private information has been disclosed without permission. Once the breach has been contained and the risks evaluated, the individual associated with the breach should be notified immediately via phone, letter or in person.
Notifications should include:
- Date of the breach
- Description of the breach
- Description of the information that was breached
- The steps taken to contain and evaluate the situation
- Preventative steps to be implemented to reduce any future breach
- Contact information of the individual(s) responsible for responding to the breach to keep the lines of communication open
- Police – identity theft or possible other crimes
- Professional or regulatory bodies – examples; WSIB, private insurance, MCURES, CCO, NSLSC, etc. (related to your specific jurisdiction)
- Provincial and Federal Information and Privacy Commissioner Banks, Credit Card companies.
- Prevention of the Breach. After the breach has been contained, the risks have been evaluated and the pertinent individuals have been informed, it is important to investigate the cause of the breach. Once the cause has been determined, it is necessary to develop and implement new safeguards against further breaches. Train your staff about the importance of privacy protection and compliance and the obligation to prevent privacy breaches. Have your staff sign a Confidentiality Agreement. It is imperative that the staff at your college protect the integrity of the college and those individuals in it.
Contact Us
If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us.