- Part X of the Child, Youth and Family Services Act: A Guide to Access and Privacy for Service Providers
- Download the Part X guide and other resources
- Terms used in this guide
- Introduction
- Does Part X of the CYFSA apply to you?
- Collection, use, and disclosure of personal information
- Consent and capacity
- Safeguarding and managing personal information
- Access to records of personal information
- Correction of records
- Offences and immunity
- Definitions
- FAQs
- Back to Guidance for organizations
Public statement about information practices
You must make a written statement about your information practices available to the public. |
You must make a written statement about your information practices available to the public. This could be included on your website or on posters or brochures in your workplace.91
Your public statement must include an easy-to-understand description of:
- your information practices (This means your policies for collection, use, modification, disclosure, retention and disposal of personal information, as well as the safeguards you have in place to protect the information92)
- how an individual may obtain access to or request correction of a record of personal information held by your organization
- how to contact your organization
- how to make a complaint to your organization and to the IPC
It is good practice to write clear, concise statements describing the information practices of your organization, taking care to avoid technical and legal language. You can consider providing additional details through a separate document. For example, a poster in your waiting room could provide a high-level statement about your information practices, which directs readers seeking more detail to a brochure or website.
If you use or disclose personal information outside the scope of your publicly stated information practices, and without consent, you are required to inform the individual at the first reasonable opportunity. You are also required to make a note about the use or disclosure and attach it to the individual’s record.93 This might apply, for example, if you use personal information for research after stating in your description of information practice that you will only use personal information for direct service delivery.