SUMMARY OF POLICIES AND PRACTICES GOVERNING THE GOVERNANCE OF PERSONAL INFORMATION

Context

The protection of personal information is an important issue for ROYAL LEPAGE ALTITUDE.

In order to meet the legal requirements of the Privacy Act in the private sector, as amended by the Act to modernize legislative as regards the protection of personal information (Bill 25), we have implemented policies and practices applicable to all members of our organization.

Appointment of a Privacy Officer

As a first step, we have appointed a privacy officer for the protection of personal information (remykanaan@royallepage.ca) to oversee the integration and application of measures designed to ensure the protection of personal information.

Guiding principles

Next, our agency adhered to a series of 14 principles to guide our approach and promote the protection of personal information, as follows:

1. Choice and consent
2. Legitimate Purpose and Limiting Collection
3. PI life cycle
4. Accuracy and quality
5. Transparency and notification
6. Individual participation
7. Empowerment
8. Safety measures
9. Monitoring, measuring, and reporting
10. Prevention of harm
11. Incident management
12. Third-party management
13. Security and « Privacy by design »
14. Circulation of information and legitimate restrictions

Roles and obligations

In another section, we have defined the roles and obligations of the members of our agency regarding the protection of personal information, including the Board of Directors, senior management, the officer responsible for the protection of personal information and employees in general. To ensure the cohesion and compliance of our agency members, this is supported by an annual training program.

Consent

Given that consent is one of the cornerstones of the reform initiated by Bill 25, we have dedicated a section to the notion of consent, to ensure that its parameters are properly applied in the circumstances.

Retention and destruction of personal information

To tighten our control over the personal information we hold, we determine in advance the scope of the information's life cycle, based on the purposes for which it was collected, in order to predict how long it will be kept and when it will be destroyed. We will keep personal information only for as long as is strictly necessary, in accordance with applicable laws and regulations.

Security of personal information

As security measures are essential to ensure the protection of personal information, our policies and practices provide for physical, logical and organizational security measures. In addition, a section is dedicated to incident management in order to minimize the impact of such incidents, should they occur.

Rights of individuals

In accordance with Bill 25, individuals have various rights (information, correction, access, forgetting, portability), including the right to denounce any violation of these rights. To enable individuals to avail themselves of these rights, we have established a request management policy under the guidance of our Privacy Officer. Through our Privacy Policy, individuals may submit any request, which will be handled in accordance with applicable laws and regulations.

---

Update

This document was last updated on: November 1st, 2023