Personal information shall be protected by security safeguards appropriate to the sensitivity of the information. The credit union will apply the same standard of care as it applies to safeguard its own confidential information of a similar nature.  

1.7.1 Credit Union Safeguards

Credit union security safeguards will protect personal information against loss or theft, as well as unauthorized access, use, copying, modification, disclosure or disposal. The credit union will protect personal information regardless of the format in which it is held. The Privacy Officer will collaborate with third parties specializing in security safeguards, as required, to ensure the required level of protection. The Privacy Officer will conduct regular audits of organizational and employee practices related to the safeguarding of personal information. The Privacy Officer will periodically remind employees, officers and directors of the importance of maintaining the security and confidentiality of personal information. Employees, officers and directors are individually required to sign an Oath of Ethical Conduct annually, including commitment to keep member's personal information secure and strictly confidential.  

1.7.2 Third Party Agents/Suppliers Safeguards

Third Party Agents or Suppliers will be required to safeguard personal information disclosed to them in a manner consistent with the policies of the credit union. Examples include data processors, credit bureaus, cheque printers, and cheque processors. The credit union will not enter into any commercial relationships with organizations that do not agree to abide by acceptable limitations on information uses and appropriate safeguards.

The credit union will dispose of or destroy personal information in a secure manner to prevent any unauthorized access. The Privacy Officer will periodically review the disposal and destruction methods used by credit union employees.  

1.8 Principle 8 - Openness

The credit union will make readily available to members specific, understandable information about its policies and practices relating to the management of personal information. This can be accomplished through the use of brochures, information sheets, online Web information, etc.,

and must include the following information:

. The name or title and the address of the Privacy Officer who is accountable for the compliance with the credit union's policies and procedures and to whom complaints or

inquires can be directed;

. The means of gaining access to personal information held by the credit union;

. A description of the type of personal information held at the credit union, including a general account of its use; and

. The types of personal information made available to related organizations such as subsidiaries or other suppliers of services. The Privacy Officer will review the methods of dissemination, and the form in which the information is presented to ensure that it is easy to locate, understandable and accessible.

1.9 Principle 9 - Individual Access

Upon request, a member shall be informed of the existence, use and disclosure of their personal information, and shall be given access to that information. A member is entitled to question the accuracy and completeness of the information and have it amended as appropriate. All access requests must be submitted in writing and include adequate proof of the individual's identity or right to access, and sufficient information to allow the credit union to locate the requested information.

In certain situations, the credit union may not be able to provide access to all the personal information it holds about a member. Exceptions to the access requirement will be limited and specific and include the following:

1. Providing access would reveal personal information about a Third Party;

2. The personal information to which the member has requested access has been requested by

a government institution for the purposes of enforcing any laws, carrying out an investigation

related to the enforcement of any law, the administration of any law, the protection of national

security and the defense of Canada or the conduct of international affairs;

3. The information is protected by solicitor-client privilege;

4. Providing access would reveal confidential commercial information;

5. Providing access might threaten the life or security of another individual;

6. The information was collected without knowledge or consent for purposes related to

investigating a breach of an agreement or a contravention of the laws of Canada or a province; or

7. The information was generated in the course of a formal dispute resolution process.

The Privacy Officer must be made aware of any situations involving employees, members or other individuals that would result in legal restrictions on access.

1.9.2 Treatment of Opinions and Judgments

The credit union cannot withhold from a member any opinions and judgments formed about the member as a basis for determining their eligibility for any products and services. The credit union will provide a member, upon written request, access to all information that may have been used in making a determination about a member's eligibility for a service, other than in the specific restriction mentioned above in Policy 1.9.1 Restricting Access.

1.9.3 Timeframe for Response

The credit union shall respond to a member's request within 30 days. This timeframe can be expanded, only if required, and upon written notification to the member.

1.9.4 Cost of Response

At the Privacy Officer's discretion, the credit union may impose a fee at a stated hourly rate where collection of the requested information requires exceptional time and effort. The member must be informed of an estimate of costs prior to the commencement of the request.

1.10 Principle 10 - Challenging Compliance

Any individual, not just a member or a credit union employee, can challenge the credit union's compliance with any of the Code principles. The Privacy Officer is accountable for the credit union's compliance and shall investigate all complaints. Accordingly, the Privacy Officer shall be known to staff and identified to members periodically.

1.10.1 Inquiry and Complaint Handling Process

The Privacy Officer will create and maintain documented procedures to respond to a credit union member or employee's questions or concerns. These procedures must be readily accessible to credit union members and employees, and must be simple to use.

Inquiries and complaints must be in writing, with a formal process in place to receive and track them and the credit union must respond as quickly as possible within 30 days.

1.10.2 Required Measures for Justified Complaints

The Privacy Officer is responsible for ensuring appropriate measures are taken when a complaint is found to be justified. These measures will include:

. Written response to the complainant within the specified timeframe of 30 days;

. Revision of the challenged personal information;

. If required, revision to policies and procedures;

. Review of any complaint that requires disciplinary action against a credit union employee with the appropriate Manager(s);

. Reporting of the non-compliance to the Board of Directors, including the actions proposed or taken to resolve the issue, as specified in Policy 3.1.4 Board Reporting and Notification.