Privacy Policy

Name of Policy: Privacy Policy	Responsible Department: Human Resources & Safety
Date Established: MACROBUTTON (MMMM/DD/YYYY May 6, 2010	Last Revision Date: January 24, 2019	Next Review Date: January 2022

1. Purpose and Scope

a) Purpose

Peterborough Utilities Group (PUG) is committed to keeping the personal information of its customers accurate, confidential, secure and private. Our Policy has been designed to inform employees, customers and contractors of PUG's commitment and recognition of our obligation to meet the spirit and terms of the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Our Privacy Policy describes the principles by which PUG protects the privacy of personal information in its possession. It addresses the reasons why such information is collected, how it is used, how its confidentiality is protected and outlines the customers' rights in respect to this information, as devised by the Canadian Standards Act.

The Privacy Policy does not apply to information about business customers who carry on business as corporations, partnerships or other forms of association. PUG does, however, protect the confidentiality of such information in accordance with the law and its own policies.

b) Scope

This policy applies to the Peterborough Utilities Group consisting of City of Peterborough Holdings Inc. (“COPHI”), and its wholly owned subsidiary companies, Peterborough Distribution Inc. (“PDI”), Peterborough Utilities Inc. (“PUI”), Peterborough Utilities Services Inc. (“PUSI”), Peterborough Utilities Commission (“PUC”), and PUG Services Corp (PUGSC) for the purpose of this policy the named entities in this scope paragraph are collectively referred to as the “Company”.

1. Definitions

Not applicable

1. Roles and Responsibilities

A Privacy Officer has been appointed, and is responsible to oversee compliance with PUG Privacy Policy. PUG shall provide, upon request, the name and contact information of the Privacy Officer.

1. Application

PUG will adhere to the Personal Information Protection Principles as outlined in this policy.

4.1 Accountability

PUG is accountable for all personal information within the organization's possession or control, including any personal information that has been transferred to a third party for regulatory or legal purposes. PUG will require a comparable level of protection of this information from its third party relationships.

4.2 Identifying Purposes

PUG collects personal information only for the following purposes:

1. to establish and maintain responsible commercial relationships with clients, customers and to provide ongoing service; and
2. to meet all of its legal and regulatory requirements.

Personal information that PUG collects from customers includes:

1. the customer's name and address and other contact information, such as telephone numbers, email address;
2. the meter number;
3. facts about consumption of power, both historic and current;
4. information about a customer's transactions with us, such as account numbers, account balances, payment history;
5. credit and reference information, such as date of birth, employment information, driver's licence, previous addresses, and general financial information;
6. medical information to be used in case of emergency power outages; and
7. bank information for pre-authorized payments.

4.3 Consent

PUG will obtain an individual's consent for use and disclosure of personal information before or when it collects, uses or discloses personal information. PUG will not disclose personal information without an individual's consent only in circumstances as permitted by law. Any such requests should be forwarded to the Privacy Officer for review and consultation with legal counsel as needed.

Subject to legal or contractual restrictions, and reasonable notice, an individual may refuse or withdraw consent for shared access to their personal information at any time. Customers may contact PUG for more information regarding the withdrawal of consent and any implications of such withdrawal.

4.4 Limiting Collection

PUG shall limit the amount and type of personal information it collects to that which is necessary for the purposes identified by the Company. PUG shall collect personal information using procedures which are fair, transparent and lawful.

4.5 Limiting Use, Disclosure and Retention

PUG shall not use or disclose personal information for purposes other than those for which it was collected, unless consent is given by the individual to use or disclose it for another purpose or as required by law.

If PUG uses personal information for a new purpose, it will document this purpose.

With the consent of the customer, PUG may disclose a customer's personal information to the following;

1. an agent retained by PUG in connection with the collection of the customer's account;
2. credit grantors and reporting agencies;
3. a person who, in the reasonable judgment of PUG, is seeking the information as an agent of the customer; and
4. any other third party or parties, where the customer has provided consent to such disclosure or disclosure as required by law.

The transfer of personal data to a third party requires the completion of the Data Access Request form and sign off by a senior officer of the Company.

PUG shall maintain reasonable and systematic controls, schedules and practices for the protection of personal information. Record retention, which shall include minimum and maximum retention periods, and destruction shall apply to personal information.

PUG will keep personal information only as long as necessary for the identified purposes.

Only those employees of PUG who require access for business reasons or whose duties reasonably so require, are granted access to personal information about customers.

4.6 Accuracy

PUG will keep the personal information in its possession or control accurate, complete current and relevant based on the most recent information provided to PUG.

Personal information used by PUG shall be sufficiently accurate, complete, current and relevant to minimize the possibility that inappropriate information may be used to make a decision about a customer.

PUG shall update personal information about customers only if it is necessary for the purposes for which it was collected or upon notification by the individual requesting that their personal information be updated or amended.

4.7 Safeguards

PUG shall protect personal information with security safeguards appropriate to the sensitivity of the information.

PUG shall protect personal information from loss or theft, unauthorized access, disclosure, copying, use, modification or destruction through appropriate security measures. PUG shall protect all personal information regardless of the format in which it is held.

The nature of the safeguards will vary depending on the sensitivity of the information, amount, distribution, format and the method of storage of the personal information. PUG will give the highest level of protection to the most sensitive personal information.

The methods of protection will include:

1. Physical security, such as locked filing cabinets and restricted access to offices;
2. Organizational security, such as security clearances and limiting access on a “need to know” basis; and
3. Technological security, such as, the use of passwords and encryption.

4.8 Openness

PUG shall make readily available to customers specific information about its policies and practices relating to the management of personal information.

PUG may make information on its privacy policies and practices available on the web page.

4.9. Individual Access

Upon request, an individual can have access to the personal information about them that PUG has in its possession or control.

Any customer may request their personal information be amended for purposes of accuracy and completeness.

Customers can make their requests by telephone (705) 748-9300, via email privacyofficer@peterboroughutilities.ca or in writing 1867 Ashburnham Drive, PO Box 4125, Peterborough, Ontario K9J 6Z5. Response to an individual's request will be made in a timely and efficient manner.

4.10 Challenging Compliance

Any customer of PUG may challenge PUG's compliance with this Privacy Policy by contacting PUG directly.

PUG shall maintain procedures for receiving, addressing and responding to all inquiries or complaints from its customers relating to its handling of personal information.

PUG shall investigate all complaints concerning compliance with the PUG Privacy Policy. If a complaint is found to be justified, the Company shall take appropriate measures to resolve the complaint including, if necessary, amending its privacy policies and procedures. A customer shall be informed of the outcome of the investigation regarding his or her complaint in a timely manner.

If individuals are not satisfied with the way PUG has responded to their complaint, they can contact the Privacy Commissioner of Canada at (613) 995-8210.

4.11 Breach of Security Safeguards

In the event that there is a breach of security safeguard involving personal information, the following will take place;

1. The individual(s) impacted will be notified in writing and the notification will include;

• A description of the circumstances of the breach;
• The day on which, or period during which, the breach occurred;
• A description of the personal information that is subject of the breach;
• A description of the steps that the affected individual could take to reduce the risk of harm resulting from the break or to mitigate that harm;
• A phone number or email address that the affected individual could use to obtain further information about the break; and
• Information about PUG's internal complaint and about the affected individuals' right, under the Act, to file a complaint with the Commissioner.

1. The Privacy Officer (or designate) will notify the Office of the Privacy Commissioner of Canada if there is reason to believe the breach involving personal information creates a real risk of significant harm to the individual(s).

1. Data breach records will be retained for a period of 24 months from the date that PUG determined the breach occurred.

1. Applicable Legislation / Reference

Personal Information Protection and Electronic Documents Act (PIPEDA)

Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)

1. Training and Compliance

New employees are trained on the Privacy Policy during orientation. Whenever the policy is reviewed and/or modified, it is communicated to all staff through electronic communication and bulletin boards.

1. Appendix / Related Documents / Links

http://www.priv.gc.ca/leg_c/leg_c_p_e.asp

http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_90m56_e.htm