Surveys, questionaires, personality tests, or other instruments that involve the collection of personal information on an individual from either a person or an entity (e.g., employee). The information obtained may include, but not be limited to, such things as ethnic origin, marital status, education, income level, and/or date of birth. [NOTE: You may need to contact your data custodian/s to determine what the policies and practices are around obtaining consent for use of these types of data. This topic will be covered in the section below on "Approval Required for External Use of Personal Information (Data Privacy)."] A data custodian can consent to the use of personal information (including data covered by the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)) with respect to its employee(s) where: the employee has been adequately informed about the processing; and the employee is required to agree to a specific use of personal information (e.g., a survey that is carried out with the specific purpose of informing the employer of its performance, policy, etc.). To find out more about this area, see: "Approval Required for External Use of Personal Information (Data Privacy)" Information that, either because it is of no interest to the organization or it was created for another purpose, is kept in a separate section or file or otherwise segregated. A person who provides goods or services to an organization in return for payment or in return for some other type of consideration. This includes vendors, consultants, and contractors. The use or disclosure of personal information by an organization for purposes other than those described in the PIPEDA Statement on Purpose(s) for Personal Information Collected and Purposes to be Gathered. A legal agreement that restricts third parties from selling or providing access to employee information outside the organization. Used with respect to a data system: hardware (i.e., computer) and software (i.e., programs). Personal information that has been made anonymous or de-identified so as to render it incapable of being used to identify a particular individual. A person or entity that is responsible for the appropriate collection, use, retention, and disclosure of personal information in compliance with the legislation. Any information about an identifiable individual, including the individual's name, title, telephone number, e-mail address, social insurance number, home address, and/or place of employment. "Personal Information Management (Privacy)" An application designed to make accessing, updating, and sharing employee information faster, easier and more convenient. It can be a standalone application or integrated into a single application such as SAP or Oracle (i.e., an "integrated ERP"). A plan adopted by an organization that establishes the procedures to be followed for the collection and use of employee information and sets out principles for the management of privacy risks. A record that documents an organization's information management practices in relation to employee personal information. Records contain descriptions of policies, procedures, programs and other activities relating to the use and maintenance of employee personal information. The use or disclosure of employee personal information for purposes other than those for which it was collected. This includes the circumstances when: the purpose for which the personal information was collected has been fulfilled; or when there is consent to the use or disclosure of the employee personal information for a purpose other than what was specified at the time of collection. The person designated by an organization to oversee and be accountable for its compliance with PIPEDA. See "Enforcement Agencies" below. Employee personal information about an individual which is held by an organization (i.e., not on behalf of another organization) as a result of, or in connection with: An individual who is employed by an organization and who performs administrative, managerial, supervisory, or professional capacity activities with respect to employee information. The use or disclosure of employee personal information for which consent is required by law. See below under "Examples of Other Purposes." Employee personal information that is used to assist an employer to determine whether an individual meets eligibility criteria, conditions, or standards that are used as part of the recruitment process, such as education qualifications, language skills, and/or work experience. A federal statutory authority that monitors compliance with the Privacy Act of Canada in order to detect and prevent violations of the Act. In Ontario, a Privacy Commissioner can be contacted at: A term used to refer to employees and non-employees (i.e., directors, officers, directors, partners, service providers, volunteers, temporary employees, contractors) of an organization. The process of protecting employee personal information from unauthorized access, disclosure, copying, use, modification or destruction by encrypting it with a cryptography key and other security safeguards that make the information unintelligible to anyone who does not have possession of the key. See "Encryption" below under "Security Safeguards." An individual with whom the organization has an established relationship by reason of the person's professional or occupational duties (e.g., consultants or independent contractors) or volunteerism (e.g., members or directors). Personal information is collected on behalf of an organization from each of these individuals. A person or entity that provides goods or services to an organization in return for consideration (i.e., payment, services, etc.). The purpose for which personal information was collected, as identified on the statement itself or in another document related to the collection of employee personal information. A person or other entity other than the individual or the organization to whom employee personal information pertains. Personal information that is used by an organization as part of its regular business activities and for which employee consent is not required by law. To request consent for other purposes, consult your data custodian. You may also wish to refer to your compliance officer's advice. Personal information about an individual that is collected, used, and disclosed by an organization for a purpose that is not related to the employment relationship (e.g., as part of a survey of customers). Employee personal information in addition to that provided on a written application form. You should note that additional employee personal information may be collected by the organization from each employee for the purposes of employment administration (e.g., benefits, pensions, or training). A federal statutory authority that monitors compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) in order to detect and prevent violations of the Act. Personal information about an individual that is collected, used, disclosed, or retained by an organization for any purpose other than the purposes listed in this Statement on Purpose(s) for Personal Information Collected and Purposes to be Gathered (e.g., because of a contractual relationship between the organization and the individual). The written agreement that sets out the terms of use of employee personal information by an organization and is signed by the employee(s) or candidate(s) when accepting employment with the organization. A person or entity designated by an organization to oversee its compliance with PIPEDA. An employee may act as a data protection officer or privacy champion if authorized to do so. To find out more about this area, see "Duty to Safeguard Employee Personal Information (PIPEDA)" A data custodian's written authorization to allow you to have access to, or use of, employee personal information (including data covered by PIPEDA) in an integrated ERP system in an approved application. Information that has been made anonymous or de-identified so as to render it incapable of being used to identify a particular individual.