Nova Scotia Health Employees Pension Plan Policy and Guidelines. Protecting the Privacy of Personal Information

Transcription

1 Nova Scotia Health Employees Pension Plan Policy and Guidelines Protecting the Privacy of Personal Information

2 TABLE OF CONTENTS What this Policy covers 3 Our Commitment to Protecting the Privacy of Your Personal Information 3 Privacy Protection in Canada.. 3 Guiding Privacy Principles... 4 What Personal Information do we collect?... 5 How is your Personal Information used?... 5 When do we disclose Your Personal Information to Parties Outside of the Plan?... 6 Safeguarding Your Personal Information.. 6 Accessing and Correcting Your Personal Information.. 6 Where to direct your questions and feedback.. 7 June,

3 What this Policy covers This Policy applies to the personal information that the Nova Scotia Health Employees Pension Plan (NSHEPP) collects, uses and discloses in the course of administering Plan benefits for its members, its pensioners, their spouses, or their beneficiaries. Some examples of personal information are: social insurance number proof of age earnings marital status A complete list of personal information collected by the Plan is contained further on in this document. Our Commitment to Protecting the Privacy of Your Personal Information The Internet and have significantly impacted the way we communicate and conduct business today. Most feel positive about the immediacy and productivity gains these new media bring. At the same time, many are concerned about how well the organizations that they deal with protect the privacy of their personal information as they conduct their day-to-day business activities. It is against that backdrop that NSHEPP is pleased to present its Policy for protecting the personal information of our Members. Protecting the privacy of your personal information has always been, and will continue to be, a high priority of NSHEPP. We use numerous security safeguards and follow the principles outlined throughout this document to ensure that the privacy of your personal information is protected. Privacy Protection in Canada NSHEPP s Privacy Policy and Guidelines has been modeled on the standards established by Canada s Personal Information Protection and Electronic Documents Act (the PIPEDA). The PIPEDA is essentially about balance. On one hand, it respects an individual s right to privacy. On the other, it recognizes that organizations need to collect, use and disclose personal information in the course of conducting their business. This law, as its name suggests, encompasses two primary objectives: 1. to establish rules that govern the collection, use and disclosure of personal information by organizations; and, 2. to acknowledge the validity and legality of electronic documents. The heart of the PIPEDA is based on the Ten Principles established by the Canadian Standards Association s Model Code for the Protection of Personal Information. These principles were recognized as a Canadian standard in 1996 and address the ways that organizations should collect, use, and disclose personal information. They also address an individual s right to access his/her personal information and his/her right to have it amended as appropriate. In the absence of substantially similar legislation in Nova Scotia, the PIPEDA applies to NSHEPP. For more information regarding this legislation, visit the official website of the Privacy Commissioner of Canada at June,

4 Guiding Privacy Principles Our policies and procedures for protecting the personal information of Plan Members are guided by the following 10 principles: 1. Accountability NSHEPP is responsible for protecting the privacy of the personal information it collects or maintains for its Plan members. The Plan will designate an individual or a team to lead the Plan s privacy protection initiatives. 2. Identifying Purposes The purposes for which personal information is collected, used and disclosed will be identified before or at the time the information is collected. 3. Consent Your consent for the Plan to collect, use, and disclose your personal information for the purpose of administering your participation in the Plan is implicitly given when you enroll in the Plan. No other consent form is required. 4. Limiting Collection The personal information collected will be limited to those details necessary for the purposes required by the Plan and applicable law. Information will be collected by fair and lawful means. 5. Limiting Use, Disclosure and Retention Personal information will only be used or disclosed for the purpose for which it was collected unless the Member has otherwise consented, or when it is required or permitted by law. Personal information will only be retained for the period of time needed to satisfy the purpose for which it was collected, and as required by applicable laws. 6. Accuracy Personal information will be maintained in as accurate, complete and up-to-date form as is necessary to fulfill the purposes for which it will be used. Members must advise their employer of all changes to their personal information required by the Plan. 7. Safeguarding Member Information Personal information will be protected by security safeguards that are appropriate to the sensitivity of the information. 8. Openness The Plan will communicate to its Members the policies and practices that apply to the management of their personal information. 9. Member Access A Member will be informed of the existence, use and disclosure of their personal information, and shall have access to it, upon request. Members may verify the accuracy and completeness of their information, and may request that it be amended, as necessary. 10. Handling Complaints and Suggestions Members are encouraged to provide feedback on these policies and procedures. Members may direct their questions, complaints, suggestions to the Plan s Privacy Officer. Please see the section Where to Direct Your Questions and Feedback at the end of this document. June,

5 What Personal Information do we collect? We collect personal information about you from both you and your employer. Your consent for us to collect and use this information is implied as part of the Plan s enrolment process. As a condition attached to membership in the Plan, you and your employer must provide the personal information that is required by the Plan to meet its administration and legal obligations. The personal information that the Plan collects for each of its Members includes: your name your address your optional contact information (telephone number; address, fax number) your employer s name your Social Insurance Number (SIN), your birth date your marital status if applicable, your spouse s name, SIN and birth date the name(s) of your beneficiary(ies) your payroll information for each calendar year: o pensionable earnings, o pensionable hours, o contributions paid o unpaid employer-approved leaves of absence taken o benefits received from an employer-sponsored Long Term Disability plan o benefits received from the Workers Compensation Board (WCB) the date when your current period of continuous employment started the date you became a contributing member of the Plan any other information not listed above that may be required so that the Plan administrator may meet all of its administration, fiduciary, and legal obligations. How is Your Personal Information Used? The personal information that we collect from you, or about you from your employer, is essential to allow us to fulfill our administrative and legal responsibilities as Plan administrator of a registered pension plan. For example, we must: administer your pension benefits accurately, according to the provisions of the Plan; and meet all reporting requirements specified by the laws applicable to registered pension plans. Specifically, we need your personal information to calculate the pension benefit entitlements you earn each year provide information about the annual pension benefit you earn each year to your employer so that your employer can calculate and report your Pension Adjustment (PA) to the Canada Revenue Agency (CRA ) prepare and send to you your Annual Pension Plan Statement prepare pension estimates that project your future pension entitlements at retirement calculate your pension benefits at termination of employment, retirement or death identify an ex-spouse s or common-law partner s entitlement to a future pension benefit, in cases where a court order or a separation agreement directs us to split your benefits because of a breakdown in your marriage or common-law relationship identify who is entitled to receive benefits from the Plan upon your death. June,

6 When Do We Disclose Your Personal Information to Parties Outside of the Plan? We may provide your personal information to any one of the following organizations outside of the Plan, in the normal course of administering the Plan, for the specific purpose indicated below: Name of Organization Canada Revenue Agency (CRA) Reasons for providing your personal information to outside organization The Plan must provide your personal information to CRA to meet their reporting requirements (e.g., past service pension adjustments when past service is purchased; pension adjustment reversals in the year of termination of employment). Mercer Human Resource Consulting Eckler Partners Limited Ernst & Young LLP Iron Mountain RBC Global Services Mercer Human Resource Consulting is engaged by the Plan to perform various actuarial services (e.g., periodic actuarial valuation reports). In virtually all cases, the personal information we give to Mercers is anonymous your name is not required. In cases, requiring your name, Mercers are contractually committed to protecting the privacy of your personal information. Eckler Partners Limited is the licensor of the computerized pension administration system used by the Plan. They develop improvements and conduct maintenance routines on that system. Therefore, they have access to your personal information contained in the pension administration system. They are contractually committed to protecting the privacy of your personal information. Ernst & Young LLP conducts independent audits of the financial aspects of the Plan. Therefore, they are required to have access to all records of the Plan, including your personal information. They are contractually committed to protecting the privacy of your personal information. Iron Mountain provides an off-site document storage service for non-current documents that must be retained by the Plan. They are contractually committed to protecting the personal information contained in the documents they store. RBC Global Services is the Custodian of the fund of NSHEPP. They issue all pension benefits payments from the pension fund. We must provide them with personal information about you at the time a benefit from the fund becomes payable to you. NOTE: We will only respond to requests from third parties for information about you (for example, from personal financial planners, agents, lawyers, other pension plans, your spouse or family, or other advisors) when you have given us your written authorization to do so. Safeguarding Your Personal Information All the personal information we collect about you is located in secure premises, access-controlled file rooms, and password-protected computerized systems. Agreement to protect the privacy of the personal information of our Members is a condition of employment for all Plan staff. Third parties with whom the Plan conducts business (as shown in the table above) must commit to protecting the personal information of our members in their contracts. Accessing and Correcting Your Personal Information Please contact your employer if you need to correct any of your personal information held by the Plan. Your employer will forward all correction requests to us. This procedure will ensure that your primary employment records are also changed, if necessary. June,

7 Where to direct your questions and feedback The Plan has a Privacy Officer. Please direct all of your questions and feedback about this document, or any issue that you wish to raise about the Plan s policy for protection of your personal information to: Nova Scotia Health Employees Pension Plan Attention: Privacy Officer 2 Dartmouth Road Bedford, N.S. B4A 2K7 June,