River City Chartered Professional Accountants LLP
Personal Information Protection Policy
River City Chartered Professional Accountants LLP (further referred to in this document as: RCCPA) is committed to safeguarding the personal information entrusted to us by our clients, as well as our partners and employees. We manage your personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA) and other applicable laws. This policy outlines the principles and practices we follow in protecting your personal information.
This policy applies to RCCPA and to any person providing services on our behalf. A copy of this policy is provided to any client, partner or employee on request.
What is personal information?
Personal information means information about an identifiable individual. This includes an individual’s name, home address and phone number, email address, age, sex, marital or family status, an identifying number, financial information, etc.
What personal information do we collect?
We collect only the personal information that we need for the purposes of providing services to our clients, including personal information needed to:
{C}· deliver requested services
{C}· prepare client tax filing information
{C}· prepare financial statements, or other accounting information
We normally collect client personal information directly from our clients. We may collect your information from other persons with your consent or as authorized by law.
All professional engagements will require you to sign an engagement letter outlining the services we have been engaged to provide. By signing an engagement letter you will be assumed by us to have agreed to the collection of information sufficient to carry out the agreed engagement. If we are required to share the information collected during our engagement with anyone outside of RCCPA, except where required by statute, that fact will be disclosed in our engagement letter.
We inform our clients, before or at the time of collecting personal information, of the purposes for which we are collecting the information. The only time we don’t provide this notification is when a client volunteers information for an obvious purpose (for example, producing a social insurance number to prepare a tax return, or, providing a cheque to pay fees when the information will be used only for payment purposes).
Consent
We ask for consent to collect, use or disclose client personal information, except in specific circumstances where collection, use or disclosure without consent is authorized or required by law. We may assume your consent in cases where you volunteer information for an obvious purpose.
We assume your consent to continue to use and, where applicable, disclose personal information that we have already collected, for the purpose for which the information was collected.
We ask for your express consent for some purposes and may not be able to provide certain services if you are unwilling to provide consent to the collection, use or disclosure of certain personal information. Where express consent is needed, we will normally ask clients to provide their consent orally (in person, by telephone), or in writing (by signing a consent form).
A client may withdraw consent to the use and disclosure of personal information at any time, unless the personal information is necessary for us to fulfil our legal obligations. We will respect your decision, but we may not be able to provide you with certain products and services if we do not have the necessary personal information.
We may collect, use or disclose client personal information without consent only as authorized, or required by law. For example, we may not request consent when the collection, use or disclosure is required:
in an emergency that may threaten the life, health or security of an individual; or
to comply with the performance of mandatory practice inspections by our designated accounting regulatory body; or
to comply with a subpoena, a warrant or an order made by a court or other body with appropriate jurisdiction; or to comply with rules of conduct required by regulatory bodies; or
to comply with a government institution that has requested the information, identified its lawful authority, an indicates that disclosure is for the purpose of enforcing, carrying out an investigation, or gathering intelligence relating to any federal, provincial or foreign law; or suspects that the information related to national security or the conduct of international affairs; or is for the purpose of administering any federal or provincial law; or
to an investigative body or government institution on our initiative when we believe the information concerns a breach of an agreement, or a contravention of a federal, provincial, or foreign law, or we suspect the information relates to national security or the conduct of international affairs.
How do we use and disclose personal information?
We use and disclose client personal information only for the purpose for which the information was collected, except as authorized by law. For example, we may use client contact information to notify you of changes at our office.
If we wish to use or disclose your personal information for any new business purpose, we will ask for your consent. We may not seek consent if the law allows this (e.g. the law allows organizations to use personal information without consent for the purpose of collecting a debt).
What is personal employee information?
Personal employee information is personal information about an employee which is collected, used or disclosed solely for the purposes of establishing, managing or terminating an employment relationship. Personal employee information may, in some circumstances, include a Social Insurance Number, a performance review, etc.
We can collect, use and disclose your personal employee information without your consent only for the purposes of establishing, managing or ending the employment. We will provide current employees with prior notice about what information we collect, use or disclose and our purpose for doing so.
What personal employee information do we collect, use and disclose?
We collect, use and disclose personal employee information to meet the following purposes:
Determining eligibility for employment, including verifying qualifications and references
Establishing training and development requirements
Assessing performance and managing performance issues if they arise
Administering pay and benefits
Processing employee work-related claims (e.g. benefits, insurance claims)
Complying with applicable laws (e.g. Canada Income Tax Act, Alberta Employment Standards Code)
We only collect, use and disclose the amount and type of personal employee information that is reasonable to meet the above purposes. The following is a list of personal employee information that we may collect, use and disclose to meet those purposes.
Contact information such as your name, home address, telephone number
Criminal background checks
Employment information such as your resume (including educational background, work history and references), reference information and interview notes, letters of offer and acceptance of employment, policy acknowledgement forms, background verification information, workplace performance evaluations, emergency contacts, etc.
Benefit information such as forms relating to applications or changes to health and insurance benefits including medical and dental care, life insurance, short and long term disability, etc.
Financial information, such as pay cheque deposit information and tax-related information, including Social Insurance Numbers
Other personal information required for the purposes of our employment
We will inform our employees of any new purpose for which we will collect, use, or disclose personal employee information, or we will obtain your consent, before or at the time the information is collected.
We will obtain your consent to collect, use and disclose your personal information for purposes unrelated to the employment (e.g. such as providing you with information about professional development programs).
What information do we provide for employment references?
In some cases, after your employment with us ends, we may be contacted by other organizations and asked to provide a reference for you. It is our policy not to disclose personal information about our employees to other organizations who request references without consent. The personal information we normally provide in a reference includes:
Confirmation that an individual was an employee, including the position, and date range of the employment
General information about an individual’s job duties and information about the employee’s ability to perform job duties and success in the employment relationship
We protect personal information in a manner appropriate for the sensitivity of the information. We make every reasonable effort to prevent any loss, misuse, disclosure or modification of personal information, as well as any unauthorized access to personal information.
In order to comply with professional standards, we are required in many cases to keep a record of the work performed by our office (“working papers”). Working papers may include personal information. We secure our working papers against inappropriate access as described elsewhere in this Privacy Policy.
We use appropriate security measures when destroying personal information, including shredding paper records and permanently deleting electronic records when appropriate.
We retain personal information only as long as is reasonable to fulfil the purposes for which the information was collected or for legal or business purposes.
Access to records containing personal information
Individuals have a right to access their own personal information in a record that is in the custody or under the control of RCCPA, subject to some exceptions. For example, organizations are required under the Personal Information Protection Act to refuse to provide access to information that would reveal personal information about another individual.
You may make a request for access to your personal information by writing to our Privacy Officer: James Filice CPA, CA, Partner (james@rcca.pro) whom is designated to ensure compliance with PIPA. You must provide sufficient information in your request to allow us to identify the information you are seeking.
You may also request information about our use of your personal information and any disclosure of that information to persons outside our organization. In addition, you may request a correction of an error or omission in your personal information.
We will respond to your request within 45 calendar days, unless an extension is granted. We may charge a reasonable fee to provide information, but not to make a correction. We do not charge fees when the request is for personal employee information. We will advise you of any fees that may apply before beginning to process your request.
Questions and complaints
If you have a question or concern about any collection, use or disclosure of personal information by RCCPA, or about a request for access to your own personal information, please contact our Privacy Officer: James Filice CPA, CA, Partner (james@rcca.pro).
If you are not satisfied with the response you receive, you may choose to contact the Information and Privacy Commissioner of Alberta.