Personal Information Protection Policy

Definitions

In this Privacy Policy:

1. “personal contact information” includes an individual’s
   1. e-mail address,
   2. phone number,
   3. mailing address, and
   4. residential address;
2. “personal identification information” includes an individual’s
   1. first name,
   2. last name,
   3. age,
   4. sex,
   5. marital status,
   6. employment information,
   7. income,
   8. social insurance number, and
   9. demographic information;
3. “subsidiaries” means constituencies, affiliate organizations, committees, departments, services, groups, offices, programs, and businesses of the Society;
4. “UBC-affiliated information” includes an individual’s
   1. UBC student number,
   2. campus-wide login,
   3. year of study,
   4. credits related to study, and
   5. faculty, program, or department of study;
5. “University of British Columbia Graduate Student Society Vancouver” means the society registered under the British Columbia Societies Act (“the Society” or “GSS” or “we”).

Purpose

The purpose of this Privacy Policy is to comply with the requirements of British Columbia’s Personal Information Protection Act (PIPA). This Privacy policy will help users understand how the Society collects, uses, discloses, and protects personal information.

Scope

This Privacy Policy applies to the collection, use, disclosure, correction, and access of personal information by and in control of the Society and its subsidiaries. Some subsidiaries may have supplementary privacy policies relating to their specific activities.

If there is a conflict or inconsistency between this Privacy Policy and those passed by the Society’s subsidiaries, this privacy policy prevails to the extent of the inconsistency.

This Privacy Policy does not apply to

1. business contact information;
2. certain publicly available information listed in section 3(2) of PIPA; and
3. personal information not subject to the requirements of PIPA.

Consent

We will obtain consent on or before the collection, use and disclosure of personal information except where PIPA authorizes otherwise.

We will inform an individual verbally or in writing, on or before collecting their personal information, of the purposes of collection. Upon request, we will provide the individual with the contact information of our Privacy Officer.

We may obtain consent explicitly, such as orally, in writing, or electronically; or implicitly by providing the individual with a notice and a reasonable opportunity to decline.

Subject to Policy 18.5.6 of this Privacy Policy, an individual may withdraw consent where they provide reasonable notice of such withdrawal. Upon receiving a notice of withdrawal, we will inform the individual of the likely consequences of withdrawing their consent.

We will stop collecting, using or disclosing the personal information upon notice of withdrawal of consent unless the collection, use or disclosure is permitted without consent under PIPA.

An individual cannot withdraw consent if legally bound, or if doing so would frustrate the performance of a legal obligation of the Society.

Types of Information

We may collect, use and disclose the following types of personal information including but not limited to

1. personal contact information;
2. UBC-affiliated information;
3. personal identification information;
4. memberships in the Society’s clubs, affiliate organizations or subsidiaries;
5. information provided for Society-sanctioned services or events;
6. information obtained through Society initiated surveys;
7. employment-related information; and 
8. financial information related to purchases of the Society’s services and products.

Purpose of Collection, Use and Disclosure

We will collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

We may collect, use, and disclose personal information for purposes not limited to

1. authenticating identity;
2. maintaining accurate membership records;
3. communicating with users of the programs, services, initiatives, and products of the Society and its subsidiaries;
4. processing any Society-affiliated promotions, awards or discounts;
5. providing, administering, and improving the services, resources, programs, events, and products of the Society and its subsidiaries;
6. planning, delivering, and evaluating programs, products, and services of the Society and its subsidiaries, and in association with third parties;
7. conducting elections, petition campaigns, and surveys;
8. processing, documenting, and handling service issues or complaints;
9. processing, documenting, and handling billing, payment, or reimbursement;
10. implementing, enforcing, and monitoring compliance with the bylaws, policies, procedures, agreements, and decisions of the Society and its subsidiaries;
11. complying with legal and regulatory requirements;
12. protecting the Society and its subsidiaries against fraud and error; and
13. safeguarding the business interests of the Society and its subsidiaries.

We will not collect, use or disclose personal information beyond what is necessary for the purposes defined in Policy 18.7.2.

Limitations

Subject to Policy 18.8.2, we will collect, use and disclose personal information about an individual only for the purposes consented to by the individual. 

We may collect, use or disclose personal information about an individual without notice or consent as permitted under PIPA.

Access to Personal Information

Where requested by an individual, we will provide them with information about the Society’s policies, practices and processes respecting personal information.

Subject to Policy 18.9.3, upon request, we will provide an individual with

1. their personal information under the control of the Society and its subsidiaries,
2. information about the ways in which the Society has been and are using the personal information, and
3. the names of individuals and organizations to whom their personal information has been disclosed to.

The Society may refuse to provide an individual with their personal information where such refusal is authorized under PIPA.

Where an access to information request is refused, the Society will

1. notify the individual in writing the details of the refusal,
2. provide the individual with information of our Privacy Officer, and
3. internally document the reason for refusal.

Accuracy and Retention of Personal Information

The Society will make a reasonable effort to ensure that personal information collected, used and disclosed by or on our behalf is accurate and complete. 

Subject to Policy 18.10.3, the Society will destroy all documents containing personal information or the means by which such information can be associated to an individual as soon as it is reasonable to assume that the purpose for which that information was collected is no longer being served and the retention is no longer necessary for business or legal purposes.

Where we use an individual’s personal information to make a decision that directly affects the individual, we will retain that information for at least one calendar year since the date of use to ensure the individual has a reasonable opportunity to obtain access to it.

Correction of Personal Information

Where requested by an individual, the Society will

1. correct an individual’s personal information under our control, and
2. send the corrected personal information to every third party to which the personal information was disclosed if it is satisfied on reasonable grounds that the request should be implemented.

Where we are not satisfied on reasonable grounds that the request should be implemented, we will annotate the personal information with the requested correction that was not made.

We will make every reasonable effort to assist an individual in accessing or correcting their personal information and to respond to them as accurately and completely as reasonably possible.

Requesting Access or Correction

An individual must make a written request, consistent with the Society’s request procedures, to access or correct their personal information under our control. The written request must include

1. the individual’s contact information, and
2. sufficient detail to enable us to identify the personal information or correction being sought.

Where a request for access or correction is made by an individual, we will generally fulfil the request within 30 days of receiving it. We will provide written notice to the individual where additional time is required to fulfil the request.

Where we are unable to provide the requested personal information that an individual has the right of access to under PIPA, we will provide the individual with a reasonable opportunity to examine such information.

Third Parties

We may share personal information with third parties for the purposes outlined in Policy

Personal information may be processed and stored in foreign jurisdictions with different privacy laws, and the government or regulatory agencies in those jurisdictions may be able to obtain disclosure of that personal information.

Where we disclose personal information third parties, we will take reasonable measures, through contractual or other means, to ensure that

1. a comparable level of protection is implemented by such parties, and 
2. personal information is returned or destroyed once the purpose for which it was provided has been fulfilled.

Protection of Personal Information

Taking into account the volume and sensitivity of the personal information, we will ensure that personal information is secure by implementing reasonable physical, organizational, and technological security safeguards to prevent against loss, theft and unauthorized access, disclosure, copying, use, modification or similar risks to personal information.

In the case of a privacy breach, we will take reasonable measures for the protection of personal information. We will notify the affected individuals of the breach within a reasonable time.

Complaints

Where requested by an individual, we will provide them with our complaints procedure.

All inquiries, questions, and complaints regarding personal information should be directed to our Privacy Officer.

For more Information

For more information, to request access to personal information or file a complaint, please contact the Society’s Privacy Officer at ppa@gss.ubc.ca.