BOTTERELL LAW CORPORATION
EFFECTIVE JULY 1, 2019
Botterell Law Corporation (“BLC”) respects your privacy and takes responsibility for personal information under its control. The protection of personal information is subject to the provisions of the BC Personal information Protection Act (“PIPA”), and may be subject to comparable provincial or federal privacy law in Canada.
This Policy explains how we collect, use and disclose the personal information that may be provided to us by our clients, potential clients, employees and contractors. Responsibility for ensuring compliance with this Policy rests with senior management of BLC, which will designate a Privacy Officer to be accountable for compliance with this Policy and which, on request, will provide the names of those persons.
This Policy outlines the principles and practices BLC will follow in order to protect your personal information. We will make every effort to ensure the accuracy, confidentiality and security of your personal information, and will follow the legal requirements to allow you to request access to and correction of that personal information.
In the normal course, BLC will inform an individual whose personal information it collects, why and how, this personal information is being collected, used and disclosed. We will obtain an individual’s consent when such consent is required, and will manage personal information in a manner that is consistent with PIPA and that a reasonable person would consider appropriate in all circumstances.
In compliance with PIPA’s requirements, this Policy outlines the principles and practices that will be followed to protect personal information sought or held by BLC. We are committed to ensuring the accuracy, confidentiality, and security of personal information.
2. WHAT TERMS WE USE IN THIS POLICY
“collection” means the gathering, acquiring or obtaining of personal information from any person, including third parties, and by any means.
“consent” means the voluntary agreement to the collection, use or disclosure of personal information for reasonable purposes, which are made known to the individual. Consent can be express or implied. Express consent can be oral or written but is always unequivocal. Implied consent is consent that can be reasonably inferred from the action or inaction of an individual.
“disclosure” means the making of personal information available outside BLC.
“personal information” means information about an identifiable individual including, without limitation, name, age, home address and phone number, social insurance number, marital status, income, credit history, medical information, educational history or employment history. Personal information does not include the person’s name, position, title, business telephone number, business address, business email or business fax number (which information is not covered by PIPA.) It also does not include work product information of the individual.
“Privacy Officer” means the individual designated from time to time by BLC to be responsible for ensuring that BLC complies with this Policy and PIPA.
“use” means the treatment, handling, management and retention of personal information within BLC.
“work product information” means information that is prepared or collected by an employee or contractor of BLC as part of that employee’s work responsibilities. Work product information does not include information about an individual who did not prepare or collect the information.
3. WHAT THE SCOPE OF THIS POLICY IS
This Policy applies to the collection, use and disclosure of personal information by BLC.
BLC reserves the right to amend this Policy from time to time to ensure that the Policy is kept current and in compliance with PIPA and other relevant laws and legislation.
This Policy does not impose any limits on the collection, use or disclosure of personal information that is covered by one of the exemptions in sections 12, 15 and 18 of PIPA with respect to the collection, use and disclosure of personal information without consent. Some important examples of such exempted circumstances include, but are not limited to:
- when the collection use or disclosure of personal information is permitted or required by law;
- in an emergency that threatens an individual’s life, health or personal security;
- when the personal information is available from a public source such as a telephone directory or online directory;
- when BLC requires legal advice from its counsel;
- for the purposes of collecting a debt;
- to protect BLC from any allegations of fraud or from being defrauded; and
- to investigate allegations that an agreement has been breached or a law broken and, in cases of apparent urgency, to do so on an anticipatory basis.
This Policy does not impose any limits on the collection, use or disclosure of personal information that is covered by or subject to the Freedom of Information and Protection of Privacy Act or The Federal Access to Information and the Privacy Act. If BLC is subject to this federal legislation it will vary its procedures as necessary to comply with its obligations under that legislation.
BLC will only collect personal information that is necessary to fulfill any one or more of the following (or similar or related) purposes:
- To assess an individual’s suitability for employment;
- To manage our relationship with an individual as an employee or contractor;
- To provide the product, service or information we have contracted to provide to you;
- To process payments to you or from you;
- To send you information about our services;
- To manage and develop our business and operations, including transfer of data among entities providing services through BLC;
- To develop, enhance, market and provide products and services;
- To meet legal and regulatory requirements;
- For purposes identified to specific individuals or purposes obvious to specific individuals, in respect of particular collections of personal information including for example, taking photographs, conducting and recording interviews and filming; and
- To establish and maintain a responsible commercial relationship with clients.
In addition, from time to time, we may use your personal information for the following purposes:
- to detect and protect BLC and other third parties against error, fraud, theft and other illegal activity, and to audit compliance with our policies and contractual obligations;
- to understand your needs and preferences, including to contact and communicate with you and to conduct surveys, research and evaluations;
- to engage in business transactions, including the purchase, sale, lease, merger, amalgamation or any other type of acquisition, disposal, securitization or financing involving BLC;
- for any other purpose we may indicate to you from time to time.
This Policy also applies to personal information that BLC collects through its website. However, the website may contain links to other entities’ websites that are not controlled or operated by BLC. This Policy does not apply to third party websites, and BLC is not responsible for the content of third party websites or the privacy practices of third parties. Therefore, we encourage you to request and review the privacy policies of any third parties on disclosing your information to such parties or visiting such third party websites.
Unless the purposes for which BLC collects personal information are obvious and the individual voluntarily provides his or her personal information for those purposes, BLC will communicate the purposes for which personal information is being collected, either orally or in writing, before or at the time of collection.
4. HOW WE OBTAIN YOUR CONSENT WHEN USING OUR WEBSITE
Your consent can be provided in a variety of different means as noted in this Policy. Consent may also be implied where you are giving notice and a reasonable opportunity to opt out of your personal information being used or disclosed and you do not elect to opt out.
BLC will collect personal information through its website only if and when an individual chooses to complete online forms to contact us, to sign up for our email list, to provide design or product feedback or to request information and assistance from us through our website. Personal information collected through these sections of our website may include an individual’s name, email address, address, telephone number and any other personally identifiable information that you choose to provide. By providing this personal information we assume that you are an individual representing and warranting that you have the right and authority to provide all such information. By submitting personal information to BLC via the website, you are agreeing that BLC may collect, use and disclose that personal information in accordance with this Policy and as permitted or required by law.
In determining the appropriate form of consent (i.e. express or implied), BLC will take into account the sensitivity of the personal information in question. When collecting personal information of a sensitive nature, BLC will ensure that it obtains an individual’s express consent for the collection of such information.
Subject to the personal information being necessary to provide the services or product or where the withdrawal of consent would frustrate the performance of or a legal obligation, an individual can withhold or withdraw consent for BLC to use personal information for particular purposes. If an individual chooses to withdraw consent to the collection, use and disclosure of personal information, BLC will advise of the consequences of such withdrawal of consent.
5. HOW WE OBTAIN YOUR CONSENT, GENERALLY
As with consent for information collected through our website, BLC will obtain an individual’s consent to collect, use or disclose personal information collected via other means, except where, as noted below, we are is authorized to do so without an individual’s consent.
An individual may choose to provide his or her consent to the collection, use or disclosure of personal information orally, in writing, electronically, or through an authorized representative.
It may be implied that consent has been granted for the purpose of collecting, using or disclosing an individual’s personal information where consent would be considered obvious, and the affected individual voluntarily provides his or her personal information for that purpose.
An individual’s consent may also be implied where that individual is given notice of an intended use of his or her personal information and a reasonable opportunity has been provided to opt out of his or her personal information being so used.
Subject to certain exceptions (set out in sections 12, 15 and 18 of PIPA), an individual may withhold or withdraw his or her consent for BLC to make use of his or her personal information. An individual’s decision to withhold or withdraw his or her consent to certain uses of personal information may restrict BLC’s ability to provide a particular service or product to that individual. In such circumstances, BLC will explain that situation in order to provide the requisite assistance to that individual to make an informed decision about the use, collection and disclosure of his or her personal information.
BLC will only use or disclose personal information where such use or disclosure is necessary to fulfill the purposes identified in this Policy and at the time that information is or was collected.
BLC will not use or disclose personal information for any additional purposes unless BLC obtains the individual’s consent to do so.
To the extent that BLC enters into contracts or other arrangements with third parties, which involve the transfer of personal information, BLC will ensure that the third party enters into appropriate covenants with BLC to provide the same level of protection over personal information.
In some cases, BLC may seek your prior consent for the use and disclosure of your information after it has been collected, but before it is used or disclosed, for example, where BLC wants to use your personal information for a purpose not previously identified to you.
BLC will not, as a condition of supplying products or services to you, require you to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.
BLC does not attempt to obtain consent for collecting, using or disclosing your personal information by providing false or misleading information to you regarding the purposes of that collection, use or disclosure. BLC will not use deceptive or misleading practices. BLC will not sell, rent or lease your personal information to third parties unless we have obtained your prior, explicit, consent to do so.
6. HOW LONG WE KEEP PERSONAL INFORMATION
BLC will retain your personal information only as long as necessary to fulfill the identified purposes, or to fulfill a legal or business purpose.
If BLC uses personal information to make a decision that personally affects an individual, BLC will retain that personal information for at least 12 months from the date that decision has been made. This will provide a reasonable opportunity for the affected individual to request access to the personal information and, where necessary, to request that that information be amended.
BLC will develop policies and implement procedures to govern the destruction or anonymization of personal information which is no longer to be retained.
7. HOW WE KEEP PERSONAL INFORMATION ACCURATE
BLC will make reasonable efforts to ensure that all personal information it collects is accurate and complete; however, BLC will not routinely update personal information.
An individual may request that a correction be made to his or her personal information in order to ensure that it is accurate and complete. Such a request must be made in writing to BLC’s Privacy Officer and must provide sufficient information and detail to identify the personal information and the correction sought.
If the personal information is found to be inaccurate or incomplete, BLC will correct the personal information as required and requested and will send the corrected information to any organization to which BLC has disclosed the personal information in the 12 months preceding the correction. If the correction is not made, BLC will note the request for the correction in the individual’s file and notify the individual that in the judgement of BLC, the correction is not necessary, and that the information on file is accurate and complete.
8. HOW WE KEEP INFORMATION SECURE
BLC is committed to ensuring the security of personal information in order to protect it from unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks. BLC will use appropriate security measures when collecting, storing and destroying personal information.
At regular and appropriate intervals, BLC will review and update its security protocols, measures and controls to reflect technological changes and to ensure the continuing security of personal information that it collects.
BLC has implemented appropriate security safeguards to protect personal information (regardless of the format in which it is held) against loss, theft, unauthorized access, collection, use, disclosure, copying, modification or disposal.
The following is a list of the security safeguards currently in place to ensure that personal information is being appropriately protected:
- Physical measures (locked filing cabinets, drawers and offices);
- Organizational measures (limiting access on a “need to know” basis and requiring all of our contractors and server providers to provide comparable security measures);
- Information measures (briefing all BLC employees and contractors of this Policy and the importance of maintaining the confidentiality of all personal information collected by BLC to which they have access);
- Technological measures (use of user IDs, passwords, encryptions and Internet firewalls); and
- Disposal measures (when disposing of or anonymizing or redacting personal information, BLC will use appropriate security measures to ensure that personal information is not inappropriately used).
Unfortunately, no data transmitted over the Internet is ever one hundred percent secure. As a result, BLC does not represent, warrant or guarantee that personal information will be protected against loss, misuse, interception or alteration and does not accept any liability for personal information submitted to us via the Internet, nor for any third parties’ use or misuse or your use or misuse of personal information.
9. HOW WE PROVIDE ACCESS TO PERSONAL INFORMATION
An individual has the right to access his or her personal information subject to the limited exceptions contained in section 23 of PIPA.
A request to access personal information must be made in writing to BLC’s Privacy Officer and must include sufficient detail for us to be able to identify the personal information being sought. An individual may be required to provide sufficient identifying information to support a request in order to enable BLC to verify identity before providing access to personal information.
In responding to an access request, BLC will provide an individual with
- a copy of the personal information of the individual under its control, and
- on request, information about the ways in which personal information has been and is being used by BLC, and the names of the third parties to whom the personal information has been disclosed by BLC.
On receipt of a request, BLC will make the information available within 30 working days. If we need an extension in order to respond to your request, we will provide you with written notice of such extension.
BLC may charge a minimal fee for providing access to personal information. Where a fee may apply, BLC will inform the individual of the costs associated with access and provide an opportunity to decide to proceed with such a request.
If we refuse, in whole or in part, to grant your request to access your personal information we will provide written notice of that decision. This notice will include reasons for the refusal and, in particular, the exceptions in PIPA upon which we rely for our refusal. We will also advise of any recourse which is available to you as a result of our decision refusing access.
10. HOW YOU CAN ASK QUESTIONS OR COMPLAIN
An individual may, at any time, request information about this Policy and BLC’s practices by contacting our Privacy Officer at:
Botterell Law Corporation
2324 Brethour Avenue, Sidney, B.C., V8L 2A3
Attention: Privacy Officer
All complaints, concerns and questions arising out of this Policy and BLC’s privacy practices should be made in writing and directed to the Privacy Officer at the address indicated above. BLC will conduct a review into your concern or complaint. If BLC concludes that a complaint is justified, it will take appropriate measures which may include amending its policies and practices.
BLC will inform you of the outcome of its review. If you are not satisfied with the resolution proposed, you will be advised as to the appropriate procedure to elevate your concern.