The protection of personal information is an integral part of doing business at Empire Life Investments Inc. (“ELII”). Protecting personal information is important to us and this policy sets out how we collect and manage personal information in a manner that protects the personal privacy of our clients, contractors and employees.
What is Personal Information?
In this document, "personal information" means any factual or subjective information concerning an identifiable individual.
Personal information may be collected concerning a variety of individuals with whom our company does business, including from clients, beneficiaries, employees, contractors and dealers.
Personal information can be collected in a variety of forms, including written (such as correspondence and memoranda) as well as electronic communications and records, video or audio recordings and photographs.
Examples of personal information include information concerning an individual's name, age, sex, health, personal characteristics or personal and financial circumstances. Personal information can also include such things as identification numbers (such as SIN or employee numbers), banking and income information and employment records.
Personal information does not include the name, title or business address, telephone number or e-mail address of employees of an organization.
At ELII, we follow 10 privacy principles:
Principle 1: Accountability
ELII is responsible for personal information under its control and has designated an individual or individuals who are accountable for compliance with this policy.
ELII, its employees and contractors are responsible for all personal information in their possession or control, including information that has been obtained from or transferred to a third party for processing.
A Privacy Officer has been designated as accountable for adherence by ELII to this policy and applicable privacy statutes, regulations and guidelines. Where appropriate, the responsibilities of the Privacy Officer may be delegated to an individual or individuals within a particular business area familiar with the nature of the personal information collected within the area and any special needs the area may have concerning the protection of personal information.
Principle 2: Identifying Purposes
ELII will identify the purposes for which personal information is being collected before or at the time that the information is collected.
ELII collects personal information in a number of ways. For example, information may be collected on an application, during a personal interview or through other means. Prior to or at the time of collection, ELII will identify the purpose of collection. This may be communicated in writing or orally, depending upon the manner in which the information is collected.
Persons collecting personal information are expected to be able to explain to individuals the purposes for which the information is being collected.
ELII will not collect, use, or disclose information beyond that required to fulfil the purposes specified at the time of collection.
Unless the new purpose is required by law, before using personal information for a purpose not previously identified, the company will identify the new purpose and obtain the consent of the individual to its use.
Principle 3: Consent
ELII must obtain the knowledge and consent of the individual to the collection, use and disclosure of personal information, except where inappropriate.
Usually, ELII will obtain consent for the use or disclosure of personal information at the time of collection. Sometimes, consent will be obtained after the information has been collected but prior to use (for example, when the company wishes to use information for a purpose not previously identified).
ELII may seek consent in a variety of ways, depending on the circumstances and the type of information collected. The company will generally seek express consent when the personal information is likely to be considered sensitive.
Sometimes consent may be obtained from an authorized representative, such as a legal guardian or person holding a power of attorney.
Implied consent may be inferred in circumstances where the information is less sensitive and consent to collection, use or disclosure can be reasonably inferred.
In certain limited circumstances, personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal or security reasons may make it impossible or impractical to seek consent. When information is being collected for the investigation of a potential breach of contract, the prevention or detection of fraud or for law enforcement purposes, seeking the consent of the individual might defeat the purpose of collecting the information. Similarly, seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or otherwise incapacitated.
An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. ELII will inform the individual of the implications of such withdrawal, which may include the inability to administer an account and/or maintain record of the units.
Principle 4: Limiting Collection
The collection of personal information will be limited to that which is reasonably necessary for the purposes identified by ELII. Information shall be collected only by fair and lawful means.
The company will not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is reasonably necessary to fulfil the purposes identified.
Information will be collected in a manner that complies with the company's obligations to identify the purpose of collection and to obtain the consent of the individual to collection, use and disclosure of personal information.
Principle 5: Limiting Use, Disclosure, and Retention
ELII will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or in accordance with the exceptions set out above. Personal information will be retained only as long as necessary for the fulfilment of those purposes.
Personal information that has been used to make a decision about an individual will be retained long enough to allow the individual access to the information after the decision has been made.
Personal information that is no longer required to fulfil its purpose shall be destroyed in accordance with the Empire Life Record Retention policy.
Principle 6: Accuracy
Personal information will be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
The extent to which personal information shall be updated will depend upon the use of the information, taking into account the interests of the individual. Information will be sufficiently accurate, complete and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.
ELII will not routinely update personal information, unless such a process is necessary to fulfil the purposes for which the information was collected.
Principle 7: Safeguards
Personal information will be protected by security safeguards appropriate to the sensitivity of the information.
ELII has implemented security safeguards and appropriate training to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.
Security safeguards vary depending on the nature and format of the information collected. The methods of protection include physical, organizational and technological measures designed to limit access to authorized persons, ensure the integrity of the information and protect it from unauthorized use or disclosure.
Security safeguards also include steps to ensure that all third parties with whom we contract and who may be required to handle personal information have implemented comparable security measures.
Principle 8: Openness
ELII will make readily available to individuals specific information about its policies and practices relating to the management of personal information.
The information made available shall include:
- the name or title, and the address, of those accountable for the company's policies and practices and to whom complaints or inquiries can be forwarded;
- the means of gaining access to personal information held by the company;
- a description of the type of personal information held the company and a general account of its use;
- a copy of this policy and any other brochures or information that explain or elaborate upon this policy; and
- what personal information is made available to related organizations or subsidiaries.
Principle 9: Individual Access
Upon request, an individual will be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
Upon request, ELII will inform an individual whether or not is holds personal information about the individual, will permit the individual to access the information and provide an account of the use made of the information, including any disclosure to third parties (if any).
In certain situations, ELII may not be able to provide access to all of the personal information it holds about an individual. Exceptions to the access requirement will be limited and specific, and the reasons for denying access will be provided to the individual upon requests. Exceptions may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal security, or commercial proprietary reasons, information that has been obtained in the course of an investigation of a potential breach of contract or fraud, and information that is subject to solicitor-client or litigation privilege.
ELII will respond to an individual’s request within a reasonable time and at minimal or no cost to the individual. The requested information will be provided or made available in a form that is generally understandable. For example, when abbreviations or codes are used an explanation will be provided upon request. If the individual requests copies of any of the documents in the files of ELII, a reasonable fee may be charged for duplication.
When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, ELII will amend the information as required. Depending on the nature of the information challenged, amendment may mean the correction, deletion or addition of information.
When a challenge is not resolved to the satisfaction of the individual, the substance of the challenge will be recorded. The individual will also be entitled to place in the file a statement as to their position and the documents they rely on in support of that position.
Principle 10: Challenging Compliance
An individual may address a challenge concerning compliance with this policy to the Compliance Officer at ELII.
ELII will inform individuals who make inquiries or lodge complaints of the applicable complaint handling protocol.
ELII will investigate and respond to all complaints in accordance with the applicable departmental complaint handling protocol. If a complaint is found to be justified, ELII will take appropriate measures, including if necessary, amending its policies and procedures.