Policy 2023-01
1. Preamble
2. Definitions
3. Photographs and recordings
4. Confidentiality obligation
5. Collection and use of confidential information
6. Management of confidential information
7. Retention of confidential information
8. Destruction of confidential information
9. Disclosure of personal information to a third party
10. Disclosure of confidential information to the concerned individual
11. Breach of confidentiality obligation
12. Remedies
13. Individual responsible for personal information protection
Nourri-Source Laval respects the right to privacy of each individual and is committed to protecting the confidentiality of confidential information collected from all participants or employees. Generally, confidential information is available only to individuals who need access to it in the performance of their duties at Nourri-Source Laval.
1- Employee
Anyone who works for Nourri-Source Laval in return for remuneration, regardless of their employment status (temporary, permanent, contractual), including management, as well as unpaid individuals (volunteers, interns, etc.).
2- Event
Any event that Nourri-Source Laval manages, organizes, or participates in as a guest.
3- Reporting Form
A tool made available to all employees or participants to inform the person responsible for personal information.
4- Confidentiality Incident
Any unauthorized access by law to personal information or sensitive information, its use or disclosure, as well as its loss or any other form of compromise to its protection.
5- Participant
Any individual who provides confidential information to Nourri-Source Laval in connection with the realization of an event, the creation of a publication, participation in an activity or a contest, or with obtaining a service.
6- Publication
Any publication produced by Nourri-Source Laval or to which Nourri-Source Laval contributes, in any form (verbal, written, audio, video, computerized or other).
7- Confidentiality Incident Register
All information recorded about declared incidents concerning the circumstances of the incident, the number of people affected, the assessment of the severity of the risk of harm, and the measures taken in response to the incident. Relevant dates are also included: occurrence of the incident, detection by the organization, transmission of notices, if applicable, etc.
8- Serious Risk of Harm
The risk assessed following a confidentiality incident that could harm the affected individuals. This risk is analyzed by the person responsible for personal information. For any confidentiality incident, the responsible person assesses the severity of the risk of harm to the affected individuals by estimating "the sensitivity of the concerned information," "the anticipated consequences of their use," and "the likelihood that they will be used for harmful purposes."
9- Confidential Information
Any information provided or communicated to Nourri-Source Laval, on any support (verbal, written, audio, video, computerized or other), concerning a participant or an employee and that can be used to identify them, including: their name, phone number, address, email, whether they have been or are a potential participant, their gender, their sexual orientation, and any health information. For greater certainty:
10- Service or Activity
Any service that Nourri-Source Laval provides to an individual at their request, or any activity in which they participate.
3.1 Every individual has the choice to be photographed or not, or to be recorded (audio/video) or not. Each person who has been photographed or recorded has previously filled out a consent form in Appendix E.
3.2 Photographs or recordings that allow an individual to be identified as an employee of Nourri-Source Laval do not constitute confidential information relating to that individual.
4.1 Employees are required to sign the present confidentiality agreement (Appendix A) before performing their duties or executing their mandates at Nourri-Source Laval.
4.2 The confidentiality obligation applies for the duration of an employee's relationship with Nourri-Source Laval and survives the end of this relationship.
5.1 Nourri-Source Laval may, as needed, create one or more files containing confidential information about employees. The purpose of creating such files is to:
5.2 Nourri-Source Laval may, as needed, create one or more files containing confidential information about participants. The purpose of creating such files is to:
5.3 Nourri-Source Laval may only collect confidential information that is necessary for the purpose of the file and may use confidential information only for these purposes.
5.4 Confidential information may only be collected from the concerned individual, unless they consent to the collection being carried out by someone else or the law authorizes it.
6.1 The board of directors of Nourri-Source Laval appoints the person responsible for ensuring the protection of personal information. The name of the person responsible for the protection of personal information and the means to contact them must be indicated on Nourri-Source Laval's main website. The responsible person ensures the maintenance of a confidentiality incident register.
6.2 Subject to article 6.3, management is authorized to access any confidential information held by Nourri-Source Laval. Other employees are authorized to access confidential information to the extent that this access is necessary for the performance of a task in the exercise of their duties.
6.3 For the purposes of the laws, a confidentiality incident corresponds to any unauthorized access by law to personal information, its use or disclosure, as well as the loss of personal information or any other breach of its protection.
6.4 When an employee or a participant notices a confidentiality incident, they must promptly inform the management or the person responsible for the protection of personal information so that it can be recorded in the register. To do so, the employee or participant must complete a reporting form and then send it to the management or coordination or the responsible person.
The register must keep information about a confidentiality incident for a period of five (5) years.
The reporting form must include:
6.5 The management or the responsible person judges if the incident presents a "serious risk of harm." The information as well as the measures to be taken to reduce the risk of serious harm being caused to the affected individuals are entered into the register.
If the incident presents a serious risk of harm, the management or the responsible person notifies the board of directors as well as the Access to Information Commission, referred to as CAI, and the affected individuals of any incident presenting a serious risk of harm using the appropriate form.
6.6 Only the person responsible for pairing, or their replacement, with a breastfeeding mentor is authorized to access confidential information that Nourri-Source Laval holds in the context of this service. However, management may access it to the extent necessary and agreed upon in the documents defining the individualized service.
7.1 Employees who have access to files under article 6 are obligated to:
7.2 When an employee can also, in some respects, be qualified as a participant, confidential information concerning each title will be kept separately like for other participants.
7.3 Files created under this policy are the property of Nourri-Source Laval.
8.1 Subject to article 8.2, confidential information is retained only as long as the purpose for which it was collected has not been achieved unless the concerned individual has consented otherwise. This confidential information is then destroyed in a manner that the data contained therein can no longer be reconstructed.
8.2 Files concerning employees are retained by Nourri-Source Laval according to the laws in force regarding their retention period.
8.3 For greater certainty, confidential information concerning an individual who has provided a testimonial, such as their name, contact details, or a photograph, is destroyed once the testimonial is published or disseminated, unless the individual has previously consented to the retention of confidential information concerning them.
9.1 Other than in situations where the law requires it and subject to the other provisions of this article 9, confidential information may only be disclosed to a third party after obtaining the written, explicit, free, and informed consent of the concerned person. Such consent can only be given for a specific purpose and for the duration necessary to achieve it.
9.2 Confidential information may be disclosed without the consent of the concerned person if the life, health, or safety of that person is seriously threatened. The disclosure must then be made in the least harmful way for the concerned person.
9.3 As permitted by law, Nourri-Source Laval may disclose confidential information necessary for its defense or that of its employees against any claim or lawsuit brought against Nourri-Source Laval or its employees, by or on behalf of a participant, an employee, or any of their heirs, executors, successors, or assignees, including any claim emanating from the insurer of a participant or an employee.
10.1 Subject to article 10.2, participants and employees have the right to know the confidential information that Nourri-Source Laval has received, collected, and retained about them, to have access to such information, and to request that corrections be made to it.
10.2 Nourri-Source Laval must restrict access to confidential information when the law requires it or when disclosure would likely reveal confidential information about a third party.
10.3 A request from a participant or an employee related to article 10.1 must be processed within a maximum of 30 days.
11.1 An employee breaches their confidentiality obligation when this person:
11.2 In the event of a breach of the confidentiality obligation, appropriate disciplinary measures, up to and including termination of the employment contract or any other relationship with Nourri-Source Laval, will be taken against the offending party, and corrective measures will be adopted as needed to prevent such a scenario from recurring.
12.1 If it turns out that a person's confidential information has been used contrary to a provision of this policy, that person may file a complaint with the management of Nourri-Source Laval and/or the board of directors of Nourri-Source Laval if the complaint concerns management.
12.2 As provided by law, the person who has been denied access or correction of the confidential information concerning them can file their complaint with the board of directors. If the person, after 30 days, is still not satisfied with the access or correction of the confidential information concerning them, they can file a complaint with the Access to Information Commission for the examination of the disagreement within 30 days of Nourri-Source Laval's refusal to comply with their request or the expiration of the deadline to respond.
Louise Bertrand
