1. Accountability – NBDS is responsible for all Personal Information under its control.
NBDS is responsible for Personal Information in its possession or custody, including information that has been transferred to a third party for processing. It will use contractual or other means to provide a comparable level of protection for information being processed by a third party.
2. Identifying Purpose – NBDS will identify and document the purposes for which it collects, uses or discloses Personal Information at or before the time of collection.
NBDS collects, uses and discloses Personal Information concerning its members and all dentists, and dental assistants in New Brunswick for the following purposes:
- Providing licensure, providing products, services and information of interest to its members in New Brunswick;
- Providing the NB Bulletin and other information or media containing information of interest to all dentists in New Brunswick;
- Exchanging information with dental-related organizations and institutions in order to facilitate the provision of products, services and information of interest to dentists, dental assistants and dental-related organizations in New Brunswick and other provinces;
- Recording of continuing education information on personal summaries to meet guidelines as set out by NBDS bylaws.
NBDS will make a reasonable effort to specify the identified purposes, orally or in writing, to the individual from whom the Personal Information is collected either at the time of collection or after collection but before use. NBDS will state the identified purposes in such manner that an individual can reasonably understand how the information will be used or disclosed.
NBDS will identify any other purposes which may arise for the collection, use or disclosure of Personal Information at or before the time the Personal Information is collected.
If a new purpose arises in respect of Personal Information already collected, NBDS will identify the new purpose prior to the use or disclosure of the Personal Information.
NBDS collects and uses Personal Information concerning its employees to provide them with information which is relevant to their work or terms of employment or other employment related activities. NBDS does not disclose Personal Information of employees for non-employment related activities.
3. Consent – Personal Information will only be collected, used, or disclosed with the knowledge and consent of the individual, except in emergencies and on other occasions permitted or required by law.
The way in which NBDS seeks consent, including whether it is expressed or implied, may vary depending upon the sensitivity of the information and the reasonable expectations of the individual. An individual can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. NBDS will inform individuals of any implications of withdrawing consent.
Typically, NBDS will seek consent for the use or disclosure of information at the time of collection. In certain circumstances, such as a proposed use of information for new purposes not previously identified, consent may be sought after the information has been collected but before use.
NBDS will not require an individual, as a condition of the supply of its services, to consent to the collection, use or disclosure of Personal Information beyond that required to fulfill legitimate purposes.
In certain circumstances, as permitted or required by law, NBDS may collect, use or disclose Personal Information without the knowledge or consent of the individual. These circumstances include Personal Information:
- which is subject to solicitor-client privilege;
- which is publicly available;
- where collection or use is clearly in the interests of the individual and consent cannot be obtained in a timely way;
- which is required to investigate a breach of an agreement or a contravention of a law;
- required to act in an emergency that threatens the life, health or security of an individual; or
- for debt collection; or to comply with subpoena, warrant or court order.
4. Limiting Collection – NBDS will limit the amount and type of Personal Information collected to that which is necessary for identified purposes and will only collect Personal Information by fair and lawful means.
5. Limiting Use, Disclosure and Retention – Personal Information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal Information will be retained only as long as necessary to fulfil the identified purposes.
Personal Information which has been used to make a decision about an individual will be retained long enough to allow the individual access to the information after the decision has been made and, in the event of an access request or a challenge, long enough to exhaust any recourse an individual may have under the law. Where Personal Information is no longer required to fulfill the identified purposes, it will be destroyed, erased, or made anonymous.
6. Accuracy – NBDS will use its best efforts to ensure that Personal Information is accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
NBDS will use its best efforts to ensure that Personal Information that is used on an ongoing basis, including information that is disclosed to others, and information that is used to make a decision about an individual is accurate, complete, and up-to-date.
7. Security – NBDS will protect Personal Information with safeguards appropriate to the sensitivity of the information.
NBDS will protect Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification regardless of the format in which the information is held. NBDS will make its employees aware of the importance of maintaining the confidentiality of Personal Information, and will exercise care in the disposal or destruction of Personal Information to prevent unauthorized parties from gaining access to the information.
Depending on the format of the Personal Information, security measures may include physical precautions such as locking file cabinets and restricting access to cabinets, offices and files, organizational measures such as security clearances and limiting access on a need-to-know basis and technological measures including passwords and encryption.
8. Openness – NBDS will make specific information about its policies and practices regarding the management of Personal Information readily available, except to the extent that it is confidential commercial information.
Specifically, NBDS will publicize information about:
- How to obtain details of the Personal Information held on file for identified individuals;
- The type of Personal Information held by NBDS, including a general account of its use;
- What Personal Information is made available to related companies; and
- How to make requests or complaints to NBDS Chief Privacy Officer.
9. Individual Access – Upon receipt of a written request, NBDS will inform an individual of the existence, use and disclosure of his or her Personal Information and will give the individual access to that Personal Information, which may be challenged and corrected, depending on the circumstances.
NBDS will respond to all individual written requests within a reasonable time, usually about ten (10) business days, depending upon the complexity of the request and the information, and will assist any individual who informs NBDS that he or she needs assistance in preparing a request. NBDS may require an individual to provide additional information which will assist it in providing an account of the existence, use, and disclosure of Personal Information.
NBDS will usually provide the requested information without charge. However, NBDS reserves the right to impose a charge, depending on the extent of the request and retrieval of the information required. NBDS will inform the individual of the approximate amount of any charge to respond to the request and will not retrieve the information until payment is made. Requested information will be provided in a form that is generally understandable. Where possible, NBDS will indicate the source of the information.
If an individual successfully demonstrates the inaccuracy of incompleteness of Personal Information, NBDS will amend the information as required. If a challenge is not resolved to the satisfaction of the individual, NBDS will record the substance of the unresolved challenge. NBDS will advise third parties having access to the information of any amendments, or unresolved challenges, as the case may be.
In certain situations, NBDS may refuse a request or restrict access to all the Personal Information it holds about an individual. Exceptions to the access requirements will be limited and specific, as permitted or required by law. The reasons for denying or restricting access will be provided to the individual upon request, where permitted by law, and may include:
- information containing references to other individuals;
- confidential commercial information;
- information which by its nature must remain confidential;
- information collected in the course of investigating a breach of an agreement;
- information collected in the course of a dispute resolution process;
- information that is subject to solicitor-client privilege; or
- any portion of information which for, one or more of these reasons may not be readily severable from the information as a whole.
NBDS will investigate all written complaints. Should it find that a complaint is justified, NBDS will take all appropriate steps to correct the information and amend the policy or practice as required.