The privacy of our members, customers and employees is of great importance to the Canadian Produce Marketing Association (CPMA). The Canadian Produce Marketing Association (CPMA) is committed to collecting, using and disclosing personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). Personal information is any information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization. It does include such things as a person’s home address, date of birth, social insurance number, medical and financial information and email address. With respect to members and customers, personal information may be collected primarily in connection with services and products provided by CPMA. Employees may be asked to provide personal information in connection with matters relating to their employment with CPMA. In all instances, CPMA is committed to protecting the privacy of individuals by ensuring that their personal information is accurate, confidential and secure.
10 Principles of PIPEDA
Principle #1 - Accountability
The Canadian Produce Marketing Association is accountable for all personal information it collects or that is in its possession including any personal information disclosed to third parties for processing or administrative functions.
CPMA has designated a Chief Privacy Officer who is accountable for the CPMA’s compliance with PIPEDA and this Policy.
1.1 CPMA’s Chief Privacy Officer and senior management are ultimately accountable for compliance with this policy and privacy legislation, however day-to-day compliance is delegated to all CPMA employees.
1.2 Personal information that is transferred to third parties for processing will be safeguarded by way of contracts or agreements with the third parties to ensure that the third parties are also safeguarding this information.
1.3 CPMA has established practices and procedures to comply with this Policy and PIPEDA as follows:
a) procedures to protect the privacy of personal information
b) procedures to receive and respond to inquiries and complaints
d) trains staff and communicates to staff information about CPMA’s policies and procedures.
Principle #2 - Identifying Purposes for Collection of Personal Information
CPMA will identify the purpose for which personal information is collected at or before the time the information is collected unless the purpose is obvious.
2.1 CPMA collects personal information from you with your knowledge and consent for the following purposes only:
a) to communicate industry information
b) to communicate information about and to promote CPMA events
c) to produce our annual membership directory
d) to reserve hotel rooms for our annual convention and other meetings
e) to develop, enhance, market or provide products or services
f) to manage and develop the association, including staff and employment matters
g) to meet legal and regulatory requirements
Principle #3 – Obtaining Consent for Collection, Use or Disclosure of Personal Information
CPMA will not collect, use or disclose an individual’s personal information without their knowledge and consent except in certain instances where permitted by law.
3.1 CPMA will reasonably seek to obtain consent either express or implied for the collection and subsequent use and disclosure of personal information at the time of collection of the information. In certain circumstances, consent for the use and disclosure will be sought after the information has been collected, but before it is used, in particular if CPMA wants to use the information for a purpose not previously identified.
3.2 CPMA will ensure that meaningful consent is obtained for the collection, use and disclosure of personal information. To attain this, the purpose for which the information will be used will be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.
3.3 CPMA will require individual’s to consent to the collection, use and disclosure of personal information as a condition of the supply of product or service only if such collection, use or disclosure is required to fulfill the identified purpose.
3.4 CPMA will determine the type of consent required based on the type of information collected, its intended use and the sensitivity of the information.
3.5 Consent may be expressed or implied, given orally, electronically or in writing.
3.6 An individual may withdraw consent at any time on sufficient notice to CPMA subject to legal and contractual limitations. The individual will be notified by CPMA of the implications of this withdrawal.
Principle # 4 - Limiting Collection of Personal Information
CPMA will limit the collection of personal information to that which is necessary for the purposes identified by CPMA. This information will be collected by fair and lawful means at all times.
4.1 CPMA primarily collects personal information from its members, customers and employees but may also collect personal information from other sources, with the consent of the individual.
Principle #5 - Limiting Use, Disclosure, and Retention of Personal Information
Personal information will not be used or disclosed by CPMA for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information will be retained only as long as reasonably necessary for the fulfillment of those purposes or as required by law.
Principle # 6 – Accuracy of Personal Information
CPMA will make reasonable efforts to ensure that personal information of individuals is kept accurate, complete and up-to-date as is necessary for the purpose for which it is to be used.
6.1 CPMA will make reasonable efforts to obtain information from individuals in order to update information on hand if required to fulfill the purpose for which the information was collected. If CPMA is informed that the information that they hold for an individual is incorrect, CPMA will update this information as soon as possible.
6.2 Personal information will not be updated without the consent of the individual.
Principle #7 – Safeguards
CPMA will protect personal information by security safeguards appropriate to the sensitivity of the information.
7.1 CPMA will use security safeguards to protect personal information against loss or theft, unauthorized access, disclosure, copying, use, modification or destruction, regardless of the format in which it is held.
7.2 The nature of the safeguards used by CPMA will vary depending on the sensitivity of the personal information that has been collected.
7.3 CPMA will make reasonable efforts to ensure that third parties use safeguards comparable to CPMA’s to protect personal information that has been disclosed to them for the purpose of processing or other administrative purposes.
7.4 CPMA will ensure all employees are aware of the importance of maintaining confidentiality of personal information and will be trained as how to safeguard this information. Employees of CPMA are required to abide by this policy.
Principle #8 – Openness Concerning Policies and Practices
CPMA will make readily available to individuals specific information about its policies and practices relating to the management of personal information.
8.1 CPMA will make this specific information readily available to individuals in a form that is generally understandable.
8.2 CPMA will provide information about its policies and practices in various ways.
Principle #9 - Individual Access
Upon the receipt by CPMA of a written request, an individual will be informed, within a reasonable period of time following such request, of the existence, use and disclosure of his or her personal information and will be given access to that information. In certain limited circumstances, as permitted or required by law, certain information will not be disclosed to the individual.
9.1 Subject to applicable laws, upon receipt of a written request from an individual, CPMA will inform him or her whether or not CPMA holds personal information about the individual and make reasonable efforts to indicate the source of the information as well as a summary of the use of the information.
9.2 An individual may be required to provide sufficient information to permit CPMA to provide an account of the existence, use and disclosure of personal information. The information provided will be used only for this purpose.
9.3 CPMA may charge a reasonable fee to cover its cost of providing the information. CPMA will notify the individual of the estimated cost of providing the information prior to doing so and will afford the individual the opportunity to withdraw his or her request.
9.4 Upon receipt of written request, CPMA will provide an individual a list of third parties to which it may have disclosed personal information about the individual and the purpose for which the information may have been disclosed.
9.5 When an individual successfully demonstrates the inaccuracy or incompleteness of personal information held by CPMA, CPMA will amend the information as required.
9.6 CPMA may decline to provide an individual access to his or her personal information in accordance with applicable laws
Principle # 10 - Challenging Compliance
An individual can address a challenge concerning CPMA’s compliance with the above principles to the designated person accountable for compliance within CPMA.
10.1 CPMA has procedures in place to receive and respond to inquiries or complaints about this policy and its handling of personal information.
10.2 Questions and complaints regarding CPMA’s compliance with this policy may be made in writing to:
By mail: Chief Privacy Officer
Canadian Produce Marketing Association
162 Cleopatra Drive
10.3 If an individual is not satisfied that CPMA is operating in compliance with requirements of PIPEDA, the individual may file a written complaint with the Commissioner at the following address:
Federal Privacy Commissioner
112 Kent Street
Place de Ville
Tower B, 3rd Floor
Toll free: 1-800-282-1376