Purpose

Big Brothers Big Sisters of Pictou County (BBBSPC) is committed to protecting the privacy and confidentiality of employees, volunteers, youth, families, donors, partners, and organizational information. BBBSPC recognizes that maintaining confidentiality and safeguarding personal information is essential to preserving trust and supporting effective service delivery.

This policy establishes expectations regarding the collection, use, disclosure, storage, and protection of confidential and personal information in accordance with applicable legislation, Big Brothers Big Sisters of Canada standards, and organizational requirements.

Scope

This policy applies to all employees, volunteers, students, contractors, board members, and any individual acting on behalf of BBBSPC.

Accountability

BBBSPC is responsible for all personal information under its control. The Executive Director (or designate) serves as the Privacy Officer and is responsible for overseeing compliance with this policy, responding to privacy inquiries, managing privacy breaches, and coordinating access requests where appropriate.

Where BBBSPC receives or handles personal health information through Anchor Youth Space or another service partnership, it will comply with applicable privacy legislation, information-sharing agreements and the requirements of the responsible health-information custodian. Where requirements differ, the more protective requirement will apply.

Collection, Use, and Retention of Information

BBBSPC collects personal information only where necessary for legitimate organizational purposes and in accordance with applicable legal and operational requirements. This may include information related to:

  • Employment and payroll administration;
  • Benefits and entitlements;
  • Recruitment, screening, and qualification verification;
  • Emergency contacts;
  • Training, supervision, and performance management;
  • Program administration and service delivery;
  • Organizational communications and recognition;
  • Regulatory, funding, and accreditation requirements.

BBBSPC will collect only the amount and type of personal information reasonably necessary for the identified purpose and will take reasonable steps to ensure information used in decision-making is accurate, complete and current.

Wherever practical and appropriate, BBBSPC will obtain informed consent for the collection, use, and disclosure of personal information. Consent may be expressed in writing, electronically, verbally, or implied by the circumstances, except where legislation permits or requires collection, use, or disclosure without consent.

Personal information will be retained and securely destroyed in accordance with BBBSPC’s Records Retention and Destruction Policy and any applicable legal, contractual, accreditation, or funding requirements.

Confidentiality Expectations

Individuals covered by this policy are responsible for protecting confidential and personal information obtained through their role with BBBSPC.

Employees and representatives must:

  • Access information only where required to perform assigned duties;
  • Protect the confidentiality of all written, verbal, and electronic information;
  • Refrain from discussing confidential information with unauthorized individuals, including family members, friends, or others without a legitimate need to know;
  • Protect passwords, records, and system access credentials;
  • Comply with all organizational information security procedures;
  • Report any suspected privacy breach, unauthorized disclosure, or loss of information immediately.

Confidentiality obligations continue during and after the conclusion of employment, volunteer service, or association with BBBSPC.

Employees may be required to sign a Confidentiality Acknowledgement as a condition of employment or engagement.

Disclosure of Information

BBBSPC will not sell or rent personal information. Personal or confidential information may be disclosed only:

  • Where written consent has been obtained;
  • Where disclosure is required by law or regulation;
  • Where records are subpoenaed or ordered by a court;
  • Where disclosure is permitted or required by law to protect the health or safety of an individual, and only the information reasonably necessary is disclosed;
  • Where disclosure is required for audits, accreditation reviews, funding requirements, or contractual obligations involving authorized parties;
  • Where disclosure is necessary for child protection or other legislated obligations.

When information is shared with external parties, BBBSPC will make reasonable efforts to ensure appropriate confidentiality and security safeguards are in place.

Nothing in this policy limits an individual’s legal duty to immediately report suspected child abuse or neglect directly to the appropriate child and family wellbeing agency. Reports must be made in accordance with applicable legislation and BBBSPC’s child protection procedures.

Withdrawal of Consent

Individuals may withdraw or modify their consent to the collection, use, or disclosure of personal information, subject to legal, contractual, operational, or program requirements. Requests to withdraw consent should be submitted to the Executive Director (Privacy Officer) or designate. BBBSPC will advise the individual of any implications that withdrawal of consent may have on service delivery, participation, employment, volunteer involvement, or other organizational activities.

Privacy Breaches

BBBSPC is committed to responding promptly to actual or suspected privacy breaches.

A privacy breach includes the unauthorized access, collection, use, disclosure, loss, theft, alteration, or destruction of personal or confidential information.

Individuals covered by this policy must immediately report any actual or suspected privacy breach to the Executive Director (Privacy Officer) or designate.

Upon receiving notice of a privacy breach, BBBSPC will:

  • Assess the nature and scope of the breach;
  • Take reasonable steps to contain and mitigate the breach;
  • Investigate the circumstances surrounding the incident;
  • Implement corrective measures to reduce the risk of recurrence; an
  • Notify affected individuals, regulators, funding bodies, insurers, or other parties where required by law, contractual obligation, or organizational standards.
  • Document the breach, the assessment completed, the actions taken and any notification decisions.

Individuals must not attempt to investigate a breach independently and must preserve relevant records and follow directions from the Privacy Officer.

Records Security and Safeguards

BBBSPC will maintain appropriate physical, administrative, and electronic safeguards to protect confidential information, including:

  • Secure storage of paper records;
  • Password-protected systems and databases;
  • Restricted access to information based on role requirements;
  • Secure transmission and disposal of information;
  • Compliance with organizational retention and destruction procedures.
  • Appropriate safeguards for remote work, mobile devices, cloud-based systems, and electronic communications.

Access and Correction

Subject to applicable legal and confidentiality restrictions, individuals may request access to their personal information and an account of how it has been used or disclosed. BBBSPC will verify the requester’s identity and may withhold information where access would reveal another individual’s personal information or where another lawful exception applies.

Individuals who have concerns regarding the collection, use, disclosure, retention, or protection of their personal information may submit a privacy complaint to the Executive Director (Privacy Officer). BBBSPC will review and respond to privacy concerns in a timely and confidential manner.

External Websites and Electronic Resources

BBBSPC websites or communications may contain links to external websites. BBBSPC is not responsible for the privacy practices, security, or content of third-party sites.

Non-Compliance

Failure to comply with this policy may result in corrective or disciplinary action, up to and including termination of employment, volunteer service, or other relationship with BBBSPC.

CONCERNS OR QUESTIONS REGARDING BIG BROTHERS BIG SISTERS OF PICTOU COUNTY COMPLIANCE

Questions or concerns regarding Big Brothers Big Sisters of Pictou County compliance with this policy may be directed to the Privacy Officer, at bigbrothers@bellaliant.com, or by telephone at (902)752-6260.