Privacy Policy

In compliance with Act 25 amending the Act respecting access to documents held by public bodies and the protection of personal information (ATIP), the Act respecting the protection of personal information in the private sector (ATIP), as well as several other laws, PCP Aluminium is responsible for the protection of personal information held in the course of its business activities.

Responsible for the protection of personal information :

Annie Maltais

Courriel : loi25@pcpaluminium.com

Preamble

The Policy on access to documents and the protection of personal information is adopted pursuant to the Act modernizing legislative provisions regarding the protection of personal information (Bill 25), assented to on September 22, 2021, thus modernizing the framework applicable to protection of personal information.

PCP Aluminium is a Canada company subject to the Act respecting access to documents and the protection of personal information (Access Act) and must ensure compliance with the new applicable framework.

1. Objectives

The purpose of the Policy is to clarify the governance regarding personal information collected and retained by PCP Aluminium as part of its operations and to strengthen the protection of the privacy of the persons covered by it, to promote transparency and modernize the framework applicable to the protection of information.

The Policy aims at the following objectives:

1.1. Designate the person responsible for the protection of personal information and define their role and responsibilities.
1.2. Define the composition and mandate of the Committee on Access to Information and Protection of Personal Information.
1.3. Define a privacy incident management framework.
1.4. Define a management framework relating to the use or communication of personal information for the purposes of study, research, or production of statistics.

2. Scope

The Policy applies to all PCP Aluminium employees.

The Policy may also apply after the end of employment when expressly provided for or when the context lends itself to it.

The Policy also applies to any person linked to PCP Aluminium by a service or supply contract.

3. Application manager

The person responsible for access and protection of personal information is responsible for applying the Policy.

4. Roles and responsabilities

4.1. The PCP Aluminium general or operations director ensures compliance and implementation of the Access Act.
4.2. The PCP Aluminium general or operations director delegates his function as person responsible for access to documents as well as that of person responsible for the protection of personal information to the financial controller of the organization.
4.3. The person responsible for the protection of personal information exercises the functions delegated to him autonomously and independently.
4.4. The person responsible for the protection of personal information ensures the protection of personal information held by PCP Aluminium.
4.5. The person responsible for the protection of personal information ensures the distribution on the PCP Aluminium website of the documents and information provided for in the Regulation respecting the distribution of documents and the protection of personal information.
4.6. A committee on access to information and the protection of personal information (the Access Committee) is set up to strengthen the protection of personal information and promote the harmonization of practices that guide actions and influence the strategies.
4.7. PCP Aluminium employees are required to collaborate in the search for documents and information subject to any access request.
4.8. PCP Aluminium employees are required to ensure the protection of personal information and confidential information.

5. Committee on Access to Information

5.1. Composition

5.1.1. The Access and Privacy Officer acts as chair of the Access Committee for his or her respective company.
5.1.2. The Access and Privacy Officer acts as secretary of the Access Committee, and has the following responsibilities:

5.1.2.1. Convene sessions of the Access Committee for their respective company.
5.1.2.2. Prepare the minutes of each Access Committee meeting for their respective company and provide a copy to the members for review and adoption.

5.2. Sessions

Committee on Access to Information

5.2.1. Sessions are convened by means of an invitation to members of the Access Committee in the name of the Chair of the Access Committee.
5.2.2. Sessions take place at least four times a year.

5.3. Mandate of the Access to Information Committee

The responsibilities of the Access Committee include:

5.3.1. Support PCP Aluminium in exercising its responsibilities and fulfilling its obligations.
5.3.2. Define and approve guidelines for the protection of personal information.
5.3.3. Approve governance rules.
5.3.4. Render an opinion and suggest protective measures on any project for the acquisition, development, and overhaul of the information system, including video surveillance and the introduction of new technology.
5.3.5. Plan and ensure the completion of training activities.
5.3.6. Promote the orientations, directives and decisions formulated by the Commission for Access to Information.
5.3.7. Annually assess the level of protection of personal information.

5.4. Reports

5.4.1. The Access Committee makes a verbal report to the president of PCP Aluminium on the results of its work following each of its meetings.
5.4.2. He also submits to the president of PCP Aluminium, when appropriate, a summary of the progress of his work.

6. Privacy incidents

6.1. A confidentiality incident corresponds to unauthorized access by law to personal information, its use, or its communication, as well as its loss or any other form of breach of its protection.
6.2. PCP Aluminium, if it has reason to believe that a confidentiality incident involving personal information that it holds has occurred, must take reasonable measures to reduce the risk of harm being caused and prevent new incidents of the same kind. nature does not occur.
6.3. PCP Aluminium carries out the assessment of the damage according to the procedure provided for in ANNEX 1.
6.4. PCP Aluminium must keep a register of confidentiality incidents (ANNEX 2) and, upon request from the Commission for Access to Information, send it a copy.
6.5. The information contained in the confidentiality incident register must be kept up to date and retained for a minimum period of five years after the date or period during which PCP Aluminium became aware of the incident.

7. Use or communication of personal information for the purposes of study, research, or production of statistics

7.1. PCP Aluminium may use depersonalized information for study, research, or statistical production purposes with the aim of:

7.1.1. To evaluate the performance or measure the quality of the products and services offered, with a view to continuous improvement.
7.1.2. To serve the public interest, for example by conducting research on a specific subject related to its mission to develop a new program or service.

The study, research or production of statistics must relate to the mission or programs of a public body.

7.2. PCP Aluminium, when using de-identified information, takes reasonable measures to limit the risks that anyone can identify an individual.
7.3. PCP Aluminium may communicate personal information without the consent of the persons concerned to a person or organization who wishes to use this information for in the purposes of study, research, or production of statistics.

7.4. This communication may take place if a privacy impact assessment concludes that:

7.4.1. the objective of the study, research or production of statistics can only be achieved if the information is communicated in a form that allows the persons concerned to be identified.
7.4.2. it is unreasonable to require the person or organization to obtain consent from the individuals concerned.
7.4.3. the objective of the study, research or production of statistics outweighs, having regard to the public interest, the impact of the communication and use of the information on the private lives of the persons concerned.
7.4.4. personal information is used in a manner that ensures its confidentiality.
7.4.5. only the necessary information is communicated.

7.5. The person or organization who wishes to use personal information for in study, research or statistical production purposes must:

7.5.1. Make your request in writing.
7.5.2. Attach to your request a detailed presentation of the study, research, or statistical production activities.
7.5.3. State the reasons supporting that the criteria mentioned in article 7.4 are met.
7.5.4. Mention all the people and organizations to whom he makes a similar request for the purposes of the same study, research, or production of statistics.
7.5.5. If applicable, describe the different technologies that will be used to process the information.
7.5.6. If applicable, transmit the documented decision of a research ethics committee relating to this study, research, or production of statistics.

7.6. PCP Aluminium, when it communicates personal information in accordance with section 7.3, must first enter into an agreement with the person or organization to whom it transmits it according to the model provided in APPENDIX 3.
7.7. PCP Aluminium must enter in a register any communication of personal information covered by this agreement.

8. Update

8.1. The Access Committee is responsible for updating the Policy and respecting the frequency of revisions.
8.2. The Policy must be revised at least during significant changes, notably in September 2023 and September 2024.