Effective Date: August 20, 2019
Scope and Application
What is Personal Identifiable Information?
Personal information includes information such as the age, ethnic origin, opinions, evaluations, comments and medical history of identifiable individuals.
- non-personally identifiable information;
- any information that is used for the purpose of communicating with an individual in relation to their employment, business or profession, such as the individual’s name, position name or title, work address, work telephone number, work fax number or work email address;
- the name, title, business address and/or telephone number of an employee of Phase 5, where the collection, use and disclosure of that information relates to the individual’s employment with Phase 5; and
- other information about an individual that is publicly available and is specified by regulation pursuant to the Personal Information Protection and Electronic Documents Act (Canada) and the European Economic Community’s General Data Protection Regulation (GDPR).
The Ten Principles of Privacy
Principle 1 – Accountability
Phase 5 is responsible for personal information under its control and shall designate one or more persons who are accountable for Phase 5’s compliance with the following principles.
Phase 5 is responsible for personal information in its possession or control and shall use contractual or other means to provide a comparable level of protection while information is being processed or used by a third party.
- establishing privacy procedures to receive and respond to inquiries or complaints;
- training employees about our privacy policies and procedures; and
- developing publicly available information to explain our privacy policies and procedures.
Principle 2 – Identifying Purposes for Collection of Personal Information
Phase 5 shall identify the purposes for which personal information is collected at or before the time the information is collected.
Phase 5 collects personal information from the public only for the following purposes:
- to conduct quantitative or qualitative marketing and social research;
- to understand respondent opinions to establish suitability for further quantitative and qualitative marketing and social research;
- to meet legal and regulatory requirements; and
- to carry out any other purpose that the respondent has authorized or that is required or permitted by law.
Further reference to “identified purposes” mean the purposes identified in this Principle.
Phase 5 shall specify orally, electronically or in writing the identified purposes to the respondent at or before the time personal information is collected in a survey/research study. Upon request, persons collecting personal information shall explain these identified purposes or refer the individual to a designated person within Phase 5 or an individual in our client organization for which the research study is being performed, who can explain the purposes.
When personal information that has been collected is to be used or disclosed for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is permitted or required by law, the consent of the respondent will be acquired before the information will be used or disclosed for the new purpose.
Phase 5 may provide clients or other third parties with information from any survey/research study, in aggregate form. In aggregate form it is impossible to identify an individual respondent’s personal information. If data is provided, but not in aggregate form, any personal identifying information would be removed prior to sharing the data file.
Principle 3 – Obtaining Consent for Collection, Use or Disclosure of Personal Information
The knowledge and consent of an individual are required for the collection, use or disclosure of personal information, except where inappropriate.
Participation by respondents in a survey/research study is always voluntary. When a respondent agrees to participate in a survey/research study, he/she gives consent to the interview/data collection by participating.
Generally, any personal information collected in the course of an interview is not disclosed to third parties. However, occasionally, a client sponsoring a research project may want to contact respondents directly. In these cases, Phase 5 always explains the reason for the disclosure to the respondent and obtains express permission from the respondent before making any such disclosure.
A respondent is always free to choose whether or not to participate in a survey/research study, free to choose not to answer any specific questions and free to discontinue participation at any time.
In obtaining consent, Phase 5 shall use reasonable efforts to ensure that a respondent is advised of the identified purposes for which personal information will be used or disclosed. The identified purposes shall be stated in a manner that can be reasonably understood by the respondent.
Generally, Phase 5 shall seek consent to use and disclose personal information at the same time it collects the information. However, Phase 5 may seek consent to use and/or disclose personal information after it has been collected, but before it is used and/or disclosed for a new purpose.
In determining the appropriate form of consent, Phase 5 shall take into account the sensitivity of the personal information and the reasonable expectations of its respondents.
The participation of a respondent in a quantitative or qualitative marketing or social research study may constitute implied consent for Phase 5 to collect, use and disclose personal information for the identified purposes.
A respondent may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. A respondent may contact us for more information regarding the implications of withdrawing consent.
Principle 4 – Limiting Collection of Personal Information
Phase 5 shall limit the collection of personal information to that which is necessary for the purposes identified by Phase 5. Phase 5 shall collect personal information by fair and lawful means.
In conducting surveys/research studies, Phase 5 limits the amount and type of personal information it collects. We collect only the amount and type of information needed for the purposes identified to individuals.
Phase 5 collects personal information about an individual primarily from that individual or a member of that individual’s household. Except as permitted by law, Phase 5 will only collect personal information from external sources, such as client organizations, if individuals have consented to such collection.
We do not knowingly collect personal information about individuals under the age of 18 without the consent of their parent or guardian. If a parent or guardian has become aware that their Child has provided us with personal information, please contact us. If we become aware that we have collected personal information from such an individual without the consent of his/her parent or guardian, we will use all reasonable efforts to promptly delete such information from our database/servers.
Principle 5 – Limiting Use, Disclosure, and Retention of Personal Information
Phase 5 shall not use or disclose personal information for purposes other than those for which it was information shall be retained only as long as necessary for the fulfillment of those purposes.
Phase 5 may disclose a respondent’s personal information to:
- a client of Phase 5 where the respondent has consented to such disclosure;
- a third party engaged by Phase 5 to perform functions on its behalf and or engaged to provide support services to us. These third-party providers only have access to personal information that is needed to perform their services and may not use it for any other purpose. They are bound by agreements that obligate them to protect respondents’ personal information; these partners are contractually bound with Phase 5 in order to ensure that respondent personal information benefits from the same levels of protection as they have when handled directly by Phase 5.
- a public authority or agent of a public authority if, in the reasonable judgment of Phase 5, it appears that there is imminent danger to life or property which could be avoided or minimized by disclosure of the information; or
- a third party or parties, where the respondent consents to such disclosure or disclosure is required or permitted by law or by order or requirement of a court, administrative agency or other governmental tribunal, or where otherwise permitted by law.
Only Phase 5’s employees with a business need-to-know, or whose duties reasonably so require, are granted access to personal information about respondents.
Phase 5 shall keep personal information only as long as it remains necessary or relevant for the identified purposes or as required by law. Depending on the circumstances, where a respondent may have to be re-contacted for purposes of clarifying responses to a survey, or to seek additional responses, Phase 5 shall retain the personal information for a period of time that is reasonably sufficient to allow this re-contact. Personal information that is no longer necessary or relevant for the identified purposes or required shall be destroyed, erased or made anonymous.
In some circumstances, we may anonymise respondent personal information (so that it can no longer be associated with the respondent) for research or statistical purposes in which case we may use this information indefinitely without further notice to the respondent.
Principle 6 – Accuracy of Personal Information
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
Personal information used by Phase 5 shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about a respondent.
Respondents have the right to view and update their personal information or ask us to delete it at any time. Simply send a detailed request to us at firstname.lastname@example.org. Phase 5 shall update personal information about respondents and employees as necessary to fulfill the identified purposes or upon notification by the individual.
Principle 7 – Security Safeguards
Phase 5 shall protect personal information by security safeguards appropriate to the sensitivity of the information.
Phase 5 shall protect personal information against such risks as loss or theft, unauthorized access, disclosure, copying, use, modification or destruction, through appropriate security measures, regardless of the format in which it is held.
Phase 5 shall protect personal information disclosed to third parties by contractual agreements stipulating the confidentiality of the information and the purposes for which it is to be used.
All of Phase 5’s employees with access to personal information shall be required to respect the confidentiality of that information.
Principle 8 – Openness Concerning Policies and Procedures
Phase 5 shall make readily available to individuals’ specific information about its policies and procedures relating to the management of personal information.
Phase 5 shall make information about its policies and procedures easy to understand, including:
- the means of gaining access to personal information held by Phase 5;
- a description of the type of personal information held by Phase 5, including a general account of its use; and
- a description of what personal information is made available to related organizations (e.g. subsidiaries).
Principle 9 – Individual Access to Personal Information
Upon request, Phase 5 shall inform an individual of the existence, use, and disclosure of his or her personal information and shall give the individual access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
Upon written request to the Privacy Officer, Phase 5 will inform an individual of the existence, use and disclosure of his/her personal information and shall be given access to that information.
In certain situations, Phase 5 may not be able to provide access to all the personal information that it holds about a respondent. For example, Phase 5 may not provide access to information if doing so would likely reveal personal information about a third party or could reasonably be expected to threaten the life or security of another individual. Also, Phase 5 may not provide access to information if disclosure would reveal confidential commercial information.
If we are unable to provide access to all or part of an individual’s personal information, we will explain our reasons for such a decision to the greatest extent permitted by law.
In order to safeguard personal information, a respondent may be required to provide sufficient identification information to permit Phase 5 to account for the existence, use and disclosure of personal information and to authorize access to the individual’s file. Any such information shall be used only for this purpose.
Phase 5 shall promptly correct or complete any personal information found to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness shall be noted in the individual’s file. Where appropriate, Phase 5 shall transmit to third parties having access to the personal information in question any amended information or the existence of any unresolved differences.
Respondents and employees can obtain information or seek access to their individual files by contacting the Phase 5 Privacy Officer.
Principle 10 – Challenging Compliance
Phase 5 shall maintain procedures for addressing and responding to all inquiries or complaints from its respondents regarding Phase 5’s handling of personal information.
Phase 5 shall, on written request, inform its respondents about the existence of these procedures as well as the availability of complaint procedures.
For Residents of the European Economic Area (“EEA”)
If a respondent is a resident of the European Economic Area (EEA), the respondent has certain data protection rights. Phase 5 aims to take reasonable steps to allow the respondent to correct, amend, delete or limit the use of the respondent’s personal information.
If the respondent wishes to be informed about what personal information we hold about them and if the respondent wants it to be removed from our systems, please contact us.
In certain circumstances, a respondent has the following data protection rights:
- The right to update or delete the information we have on the respondent.Whenever made possible, the respondent can update or request deletion of their personal information. Please contact us.
- The right of rectification.The respondent has the right to have their information rectified if that information is inaccurate or incomplete.
- The right to object.The respondent has the right to object to our processing of their personal information.
- The right of restriction.The respondent has the right to request that we restrict the processing of their personal information.
- The right to data portability.The respondent has the right to be provided with a copy of the information we have about them in a structured, machine-readable and commonly used format.
- The right to withdraw consent.The respondent also has the right to withdraw their consent at any time where Phase 5 relied on their consent to process their personal information.
Please note that we may ask the respondent to verify their identity before responding to such requests.
It is important to note that the rights set out above are not unconditional and the specific circumstances of the processing being undertaken by us will determine if these rights may be exercised. Further information concerning these rights and their application can be obtained by contacting us at the address provided below.
However, we will normally collect personal information from the respondent where the processing is in our legitimate commercial interests which are not overridden by their protection interests or fundamental rights and freedoms. Typically, our legitimate interests include but are not limited to: collecting attitudes and opinions from respondents regarding their reactions to concepts, products, services, communications, level of service received, usage, usability, etc.
In some limited cases, we may be under a legal obligation to collect, use or disclose their personal information, such as disclosure required by court order.
Where we rely specifically on express consent to collect and process personal information, the respondent is not obliged to provide consent and may subsequently withdraw consent once it has been provided.
If a respondent has any questions about or need further information concerning the legal basis on which we collect and use their personal information, please contact us at the address provided below.
A respondent may opt-out of receiving invitations to participate in a survey/research study from Phase 5 or promotional electronic messages from us, by clicking on the “unsubscribe” button provided in all such communications.
Disclaimer (Notice to Survey Respondents)
The Originator of this survey is solely responsible for its contents. Your response to the survey is voluntary. If you are asked in the survey to reveal your identity or the identity of the organization on whose behalf you are responding and do not wish to do so, please do not respond to the survey. Your response will be used by the survey Originator only for the purpose identified by the Originator.
If you are given an opportunity to submit free-form responses to a survey, please provide relevant and responsible responses; refrain from disparaging, offensive, harassing or otherwise inappropriate language and refrain from including any sensitive information of any kind. Our client does not want you to, and you should not, include in your survey response any sensitive information of any kind (e.g. credit card numbers, bank account numbers, login credentials, passwords) and any confidential or proprietary information belonging to you, to our client or any other party.
Your response will be processed and stored in Canada (or United States); if you do not wish your response and the information it contains to be processed or stored in Canada (or United States), please do not respond to this survey.
Do not forward this survey without the permission of the Originator, and please contribute to its effectiveness by responding only once.
Surveys are provided by Phase 5 on behalf of our clients, on an ‘as is’ and ‘as available’ basis. Phase 5 does not warrant that email sent on behalf of Phase 5 or email sent from our client, including this survey are free of viruses or other harmful components. Neither Phase 5 nor our client will be held liable for any damages of any kind arising from this survey, including but not limited to direct, indirect, incidental, punitive, and consequential damages.
Our client reserves the right to terminate or withdraw a survey, and your opportunity to participate in a survey, at any time and for any reason. Our client alone has the right to view and use the aggregate survey results and may choose in its sole discretion not to disclose the aggregate survey results to you.