Personal Information Protection Policy
YouthCO HIV & Hep C Society (YouthCO) believes privacy is very important, especially when it comes topics and experiences that can be stigmatized, such as our identities, HIV, Hep C, sexual health, and harm reduction. YouthCO is committed to protecting privacy and keeping information shared we collect and/or receive from participants, donors, volunteers, supporters, members, partners, and staff members confidential, safe, and secure. By collecting information about individuals, YouthCO accepts responsibility for keeping this information safe to the best of our abilities.
YouthCO follows the requirements of British Columbia’s Personal Information Protection Act (PIPA), which provides ground rules for how BC organizations may collect, use and disclose personal information.
YouthCO is required to follow rules and regulations about collecting and storing personal information that are set by colonial governments in what we now call British Columbia and Canada.
In this policy, YouthCO wants to share information about the types of personal information that it collects and uses, and in what ways information is stored and shared. YouthCO wants to share the choices we have about what information YouthCO collects, when YouthCO needs explicit consent from us to collect our information and when YouthCO does not, and how each of us can access or correct our personal information at YouthCO.
What does personal information mean?
Personal information means information that can be used to identify a specific person, such as a person’s name, phone number, or social media handles. Personal information does not include information that allows us to contact a person at work, such as a person’s job title, business number or email.
PIPA provides additional definitions that are used in some privacy policies but are not used in YouthCO’s policy.
Section 1- What personal information does YouthCO collect?
YouthCO collects personal information for a number of different reasons, depending on our relationship with YouthCO. YouthCO limits the amount of personal information that is collected about us to meet YouthCO’s programming needs, and the rules YouthCO is required to follow.
The most common information that YouthCO collects and stores about us is our name and contact information. YouthCO collects this information from program participants, donors, volunteers, members, and staff members. YouthCO also collects information about how we participate as donors, and program participants in the organization’s activities.
The type and amount of personal information YouthCO collects varies! Here are some examples:
YouthCO limits the situations when it collects our legal name because YouthCO affirms the name each person chooses for ourselves.
- For example, YouthCO may need our legal name to pay us by direct deposit, issue official donation receipts, make our travel arrangements, register us as a director on the YouthCO board, or provide a T4 or T4A.
YouthCO limits the situations when it collects information about our health.
- YouthCO recognizes that medical information is private.
- YouthCO may need information about our health to provide emergency care or to ensure we can participate in programs or services that are based on HIV or HCV status.
Section 2 – Why does YouthCO collect personal information?
The main reasons YouthCO collects personal information are to:
- Provide programming and support to youth impacted by HIV and Hep C across British Columbia (e.g. case notes for youth we provide one on one support to)
- Let people know what is happening at YouthCO!
- Recognize people who make YouthCO’s work possible
- Comply with legal, regulatory, and audit requirements (especially for staff members and people we are paying)
YouthCO collects personal information for a number of different reasons, depending on our relationship with YouthCO. YouthCO will ensure the reason why our personal information is being collected is either obvious, or explained to us in writing or out loud.
If we do not understand why YouthCO is collecting our personal information, we can ask for additional information, or wait to provide information at another time.
Section 3 – What control do we have over the personal information YouthCO collects or shares?
Under PIPA, our consent for YouthCO to collect personal information is implied in two situations:
- where the purpose for collecting, using or sharing our personal information would be considered obvious, and we voluntarily provide personal information for that purpose.
- where we are given a reasonable opportunity to opt-out of our personal information being used for mail-outs, communications, or fundraising, and we do not opt-out.
In these two situations, YouthCO does not have to explicitly ask us for our consent to collect personal information.
In all other situations, YouthCO will only collect personal information from us if we provide explicit consent, or, if we are under the age of 18, our parent or guardian has provided consent.
We do not have to give YouthCO consent to collect our personal information. We can always change our mind after giving YouthCO our personal information. In some situations, our decisions about what personal information to provide or not provide to YouthCO may impact the programs or services YouthCO is able to provide. For example, YouthCO cannot pay staff members a salary without a Social Insurance Number, and YouthCO cannot host campers or volunteers at Camp Moomba without emergency and medical information.
There are limited situations where YouthCO may use or share personal information without our consent. These situations are:
- when the law requires YouthCO to share information (e.g. if a person at YouthCO believes we are in immediate danger)
- if there is an emergency that threatens our life, health, or personal security;
- when the personal information is available from a public source (e.g. a public social media profile)
- When YouthCO requires legal advice from a lawyer;
- When YouthCO needs to protect itself from fraud;
- When YouthCO is involved in investigating circumstances where an agreement may be breached or a law may be broken.
Section 4 - How does YouthCO use and share personal information?
YouthCO will only use or disclose our personal information in the ways we were told about at the time our personal information was collected, or for related purposes. Related purposes may include YouthCO contacting us for feedback, or letting us know about things happening at YouthCO we may be interested in.
If YouthCO wants to use or share our personal information for any other reason, or we want YouthCO to share our information with another party, YouthCO will ask us for consent before doing so. For example, we may want YouthCO to share information about us with another organization as part of supporting us. For example, this could be a membership application at Positive Living BC. YouthCO will only share our personal information with another organization if we agree ahead of time.
YouthCO will never sell our personal information to any person, organization, service provider, or business.
Section 5 - When does YouthCO keep our personal information?
YouthCO will keeps our personal information on an as-needed basis. ‘As-needed basis’ includes circumstances where YouthCO may have to justify a decision that was made about us, or requirements that exist for legal, audit, funder, or regulatory purposes.
If YouthCO uses our personal information to make a decision that directly affects us, YouthCO will keep our information for at least one year.
While YouthCO has our personal information, it will be stored securely (see section 7).
Section 6 – How does YouthCO ensure our personal information is accurate?
YouthCO will take reasonable steps to ensure our personal information is accurate and complete when using it to make a decision about us. YouthCO will also take reasonable steps to ensure our personal information is accurate and complete in situations where we have provided our consent for YouthCO to share personal information with another organization (see section 4).
We can ask YouthCO to update our Personal Information to ensure it is accurate and complete by contacting YouthCO’s Privacy Officer. When YouthCO receives our request, YouthCO will check to see if the information YouthCO has matches what we have provided:
- If YouthCO needs to make an update or correction to personal information, YouthCO will also update any organizations our information has been shared with in the past year.
- If YouthCO does not make an update or make an update or correction to personal information, YouthCO will keep a copy of our request for the information to be updated.
YouthCO will let us know what actions they have taken as a result of our request within 10 business days.
Section 7 - What security measures does YouthCO use to protect personal information?
Everyone who has access to confidential information at YouthCO gets information about the importance of confidentiality and protecting personal information. YouthCO chooses third-party services that have privacy commitments in place, and/or builds in confidentiality to their agreements with YouthCO.
YouthCO also takes many steps to ensure only those people who need our personal information have access to it. These steps include physical, organizational, contractual, and technological security measures:
- Storing hard copies of information in locked cabinets which few people have access to
- Using unique passwords to protect information that is stored on YouthCO’s server, emails, and online platforms
- Limiting access to personal information to those who need it
YouthCO works to prevent our personal information from being accessed by people who have not accessed it. someone who does not need it. To do this, YouthCO stores information in secured places, such as locked filing cabinets, password-protected electronic spaces such as servers, and limiting those who have access to our personal information.
When getting rid of Personal Information after it has been used and/or stored for the required amount of time, YouthCO will shred paper copies and permanently delete electronically stored information.
YouthCO will keep our policies and practices as up-to-date as possible as technology evolves.
YouthCO will make every effort to inform us if there is a breach of the security measures in place and our information is accessed by someone who is unauthorized. In this situation, YouthCO will work to re-establish effective security measures as soon as possible, and regain our trust.
Section 8 – How can we access our personal information at YouthCO?
We have a right to access our personal information in most situations. Some exceptions are if we ask for information that includes revealing personal information about someone else.
To get our personal information, we must write YouthCO’s Privacy Officer (contact information below!), and be clear about what we are requesting. On request, YouthCO will always tell us how our personal information is used, and who it has been shared with.
YouthCO will respond to our requests within 10 business days, either with the information we requested, a reason why YouthCO cannot share the information with us, or notice that YouthCO needs more than 10 business days to get us this information.
Section 9 - How can I ask a question or make a complaint?
YouthCO has a Privacy Officer we can contact if we have questions, concerns, or complaints about how our personal information is being used! This Privacy Officer is responsible for ensuring YouthCO HIV & Hep C Society follows this policy and the Personal Information Protection Act.
If YouthCO’s Privacy Officer is unable to resolve the concern, we may also write to the Information and Privacy Commissioner of British Columbia.
YouthCO’s Privacy Officer is Sarah Chown (she, her, hers).
Sarah can be reached at firstname.lastname@example.org, or by calling 604-688-1441.