1. INTRODUCTION
The Ontario Motor Vehicle
Industry Council (OMVIC) is the
motor vehicle dealer industry's
self-management body. OMVIC is a
not-for-profit Ontario
corporation which operates under
the direction of a Board of
Directors.
OMVIC is responsible for
administering Ontario's Motor
Vehicle Dealers Act, 2002 (MVDA). Our
mandate is to maintain a fair,
safe and informed marketplace in
Ontario by protecting the rights
of consumers, enhancing industry
professionalism and ensuring
fair, honest and open
competition for registered motor
vehicle dealers. Our adherence
to these ideals is reflected in
our mission statement:
We will take pride in the
results of our commitment to a
fair marketplace, achieved
through innovation, enforcement
and excellence in service.
OMVIC came into being on
January 7, 1997. On that date,
the motor vehicle industry in
Ontario – previously regulated by
the Ministry of Consumer and
Commercial Relations (now the
Ministry of Consumer Services) became the
first regulated business sector
to move to self-management. We
became fully operational on
April 7.
OMVIC is committed to
ensuring that the privacy rights
of individuals and organizations
are both respected and balanced
with OMVIC’s role as the
industry regulator. Consequently
OMVIC has an Access and Privacy
Code (Code) that establishes the
public’s right of access to
records and personal information
and establishes the rules for
the collection, use, disclosure,
retention and security of
personal information. A copy of
this publication is available on
request.
2. THE CODE
The Administrative Agreement
between the Minister of
Consumer and Business Services and OMVIC
contains the terms of the
delegation to OMVIC for the
administration of the MVDA.
Schedule K of the Agreement
contains the terms of the Access
and Privacy Code that apply to
OMVIC records and personal
information. The Administrative
Agreement, including Schedule K,
is available on request.
OMVIC maintains the following
categories of records:
Registration, Complaints and
Adjudication, Investigation and
Inspection, Corporate and Legal,
Administration and Finance.
3. DEFINITIONS
Collection – the act of
gathering, acquiring, or
obtaining personal information
from any source including third
parties, by any means.
Consent – voluntary agreement
with what is being done or
proposed. Consent can be either
express or implied. Express
consent is given explicitly,
either orally or in writing.
Express consent is unequivocal
and does not require any
inference on the part of the
organization seeking consent.
Implied consent arises where
consent may reasonably be
inferred from the action or
inaction of the individual.
Disclosure – showing,
telling, sending or giving
personal information to some
other individual or organization
or the public, but does not
include use of the information
within OMVIC.
General information – any
information other than personal
information.
Personal information –
information about an
identifiable individual that is
recorded in any form.
Record – any record of
information, however recorded.
Registrant – a person
applying for registration under
the MVDA, persons currently
registered and former
registrants.
Use – refers to the treatment
and handling of personal
information within an
organization.
4. PRIVACY PRINCIPLES
4.1 Scope and Application
4.1.1 This
Code applies to all personal
information of registrants of
OMVIC and of members of the
public who may contact OMVIC or
lodge a complaint with OMVIC
that is in its custody or under
its control.
4.2 Accountability
4.2.1 OMVIC is
responsible for all personal
information set out in Article
4.1.1 that is either in our
custody (i.e. possession) or
under our control.
4.2.2 OMVIC
will designate one or more
persons within OMVIC to be
responsible for ensuring that we
comply with this Code. Other
individuals may be delegated to
act on behalf of the designated
person(s).
4.2.3 OMVIC
will publish the title and
contact information of the
person(s) designated to oversee
compliance with this Code.
4.2.4 OMVIC
will develop and follow policies
and practices that are
reasonable for us to meet our
obligations under this Code and
make information about these
policies and practices available
to any person upon request.
4.2.5 In
carrying out our
responsibilities under this
Code, we will do what a
reasonable person would think
was appropriate in the
circumstances.
4.3 Consenting to the
Collection, Use and Disclosure
of Personal Information
4.3.1 Before
we collect, use or disclose
personal information, we will
ask the individual that the
information is about to consent
to the collection, use and
disclosure of the personal
information or to consent to the
collection of the personal
information from someone who is
not the individual unless this
Code says otherwise.
4.3.2 OMVIC
does not need to obtain consent
to collect, use or disclose
personal information in the
specific circumstances set out
in Article 4.4.5 (collection
without consent), Article 4.5.2
(use without consent) and
Article 4.6.2 (disclosure
without consent).
4.3.3 OMVIC
will not require an individual
to consent to the collection,
use or disclosure of personal
information as a condition of
providing a service to the
individual unless the
collection, use or disclosure is
required to carry out a purpose
identified in Article 4.4.2.
4.3.4 When an
individual applies for
registration with OMVIC, this
constitutes implied consent for
us to collect, use and disclose
the individual’s personal
information for the relevant
purposes identified in Article
4.4.2.
4.3.5 OMVIC
will only use opt-out consent if
(a) we tell
individuals what the purposes
are for collecting, using or
disclosing their personal
information;
(b) we notify
them at the time of the
collection, use or disclosure
that they have the option to
opt-out;
(c) we give
them a reasonable chance to say
no to the collection, use or
disclosure; and
(d) the
information in question is not
considered sensitive.
4.3.6 An
individual may change or
withdraw his or her consent by
giving us reasonable notice of
this as long as this would not
frustrate the administration of
the MVDA or change a legal
obligation between the
individual and us. When we
receive such a notice, we will
inform the individual of the
likely consequences (if any) of
changing or withdrawing his or
her consent, which may include
disentitlement to registration.
4.3.7 OMVIC
will obtain consent to the
collection, use or disclosure of
personal information without
giving false or misleading
information about the
collection, use or disclosure or
using deceptive or misleading
practices.
4.3.8 OMVIC
will use consent clauses that
are easy to find and as clearly
worded as possible regarding the
purposes of collection, use or
disclosure.
4.3.9 OMVIC
will obtain express consent
wherever possible. In
determining what form of consent
to use, we will take into
account the sensitivity of the
personal information and the
reasonable expectations of our
registrants and the public.
4.4 Collecting Personal
Information
4.4.1 OMVIC
will only collect personal
information for purposes that
are reasonable and we will only
collect the information that is
reasonable for carrying out
those purposes.
4.4.2 OMVIC
will collect personal
information only for the
following purposes (referred to
in this Code as “identified
purposes”):
(a) creating
and maintaining records about
applications for and obtaining
registration as a registrant;
(b) creating
and maintaining records about
applications for and obtaining a
registration and for keeping
records about suspended,
refused, revoked or reinstated
registrations;
(c) creating
and maintaining records about
registrants fulfilling their
continuing education or
continuing competence
requirements;
(d) creating
and maintaining records
regarding complaints and their
resolution;
(e) lodging,
inspecting, investigating and
conducting hearings and appeals
concerning registrants before
various administrative and
judicial bodies; and
(f) meeting
other legal and regulatory
requirements including but not
limited to the scrutinizing of
potential board members.
4.4.3 OMVIC
will notify registrants,
prospective registrants or
members of the public about the
identified purposes before or at
the time the personal
information is collected and
will do this orally,
electronically or in writing. We
will also let them know who they
can contact if they have
questions about the collection
of their personal information.
4.4.4 OMVIC
will only collect personal
information directly from the
individual the information is
about unless the individual
consents to the collection of
information from another source
or the information may be
collected without consent under
Article 4.4.5.
4.4.5 OMVIC
may collect personal information
without the consent of the
individual only in the following
specified circumstances:
(a) when a
reasonable person would consider
that it is clearly in the
interests of the individual and
we cannot obtain consent in a
timely way or the individual
would not reasonably be expected
to hold back consent;
(b) when the
MVDA, another act or regulation
requires or allows for
collection without consent;
(c) if the
collection is reasonable for the
purposes of an inspection,
investigation, the enforcement
or administration of the MVDA or
other legal proceedings;
(d) if we are
determining whether an
individual is suitable for an
honour, award or other similar
benefit;
(e) if the
information is needed to collect
a debt owing to us or for us to
repay money owing to the
individual;
(f) lodging,
inspecting, investigating and
conducting hearings and appeals
concerning registrants before
various administrative and
judicial bodies;
(g) if the
information is publicly
available as defined in PIPEDA;
(h) if the
information can be disclosed to
us without consent; or
(i) meeting
other legal and regulatory
requirements including but not
limited to the scrutinizing of
potential board members.
4.5 Using Personal
Information
4.5.1 OMVIC
will only use personal
information for purposes that
are reasonable and we will only
use personal information that is
reasonable to carry out those
purposes.
4.5.2 OMVIC
will only use personal
information without the
individual’s consent for the
purposes in Article 4.4.5 and
for the following additional
purposes:
(a) if the
information is necessary to
respond to an emergency that
threatens the life, health or
security of an individual or the
public;
(b) for the
purpose of an inspections or
investigation; or
(c) for the
administration and enforcement
of the MVDA and all applicable
legislation including but not
limited to the Business
Practices Act, the Business
Names Act, the Corporations Act,
the Consumer Protection Act, and
the Sale of Goods Act (as may be
amended from time to time).
4.6 Disclosing Personal
Information
4.6.1 OMVIC
will only disclose personal
information for purposes that
are reasonable [for the
identified purposes in Article
3.3.2] and will only disclose
personal information that is
reasonable to carry out those
purposes.
4.6.2 OMVIC
will only disclose personal
information without the
individual’s consent for the
purposes in Articles 4.4.5 and
4.5.2 and for the following
additional purposes:
(a) when a
treaty requires or allows for
disclosure without consent and
the treaty is made under an act
or regulation of Ontario or
Canada;
(b) to comply
with a subpoena, warrant or
order issued by a court or
person or body having
jurisdiction to compel the
production of information or
with a rule of court relating to
the production of information;
(c) to a
government institution, part of
a government institution,
regulatory body or to a duly
designated investigative body
(as defined in PIPEDA) or to
help in an investigation or a
law enforcement proceeding;
(d) to a law
enforcement agency within Canada
or to another law enforcement
agency in a foreign jurisdiction
under an arrangement, a written
agreement, treaty or legislative
authority;
(e) lodging,
inspecting, investigating and
conducting hearings and appeals
concerning registrants before
various administrative and
judicial bodies;
(f) to the
surviving spouse or adult
interdependent partner (e.g. a
same sex partner) or to a
relative of an individual who
has died, if in our opinion, the
disclosure is reasonable; or
(g) meeting
other legal and regulatory
requirements including but not
limited to the scrutinizing of
potential board members.
4.7 Giving Access to and
Correcting Personal Information
4.7.1 OMVIC
will provide personal
information to the person to
whom it relates after receiving
a written formal request for
same. Upon a formal request, we
will give an individual or his
or her authorized representative
(an “applicant”) access to his
or her personal information in a
record that is in our custody or
under our control
4.7.2 OMVIC
will require an applicant to
give us evidence of his or her
identity so we can ensure that
the applicant has the right to
access the individual’s personal
information but we will only use
such information for the purpose
of identification and
authentication.
4.7.3 A
Director’s Certificate may also
be requested from OMVIC
regarding a registrant, which
will contain information
regarding registration dates,
business premises and
registration status.
4.7.4 OMVIC
will act reasonably in searching
for an applicant’s personal
information and will respond to
an applicant within 30 calendar
days from receiving the request,
wherever possible.
4.7.5 If OMVIC
does not have enough detail to
identify the information
requested, there is a large
amount of information requested
or to be searched, meeting the
time limit would unreasonably
interfere with the operations of
OMVIC, or more time is needed to
consult with another
organization or public body to
determine if access can be
given. OMVIC will provide
written notice that an
additional 30 days is required.
4.7.6 OMVIC
may charge the following fees
for processing the request. In
both cases stated in Article
4.7.1 (Registrant History) and
Article 4.7.4 (Director’s
Certificate), OMVIC charges the
following fees for the
production of the records:
(a) First two
hours - $50.00;
(b) Each
additional hour - $50.00;
(c)
Cost if any of retrieving the file(s) from storage;
(d)
Photocopying – $0.75 per page;
(e) Certified
Copies - $3.00 per page.
4.7.7
Registrants and members of the
public may seek access to their
personal information by
contacting OMVIC’s Chief Privacy
Officer in writing.
4.7.8 OMVIC
may refuse access to all or part
of an applicant’s personal
information in the following
situations:
(a) the
information is protected by
section 36 of the MVDA;
(b) the
information is protected by any
legal privilege;
(c) the
disclosure of the information
would reveal confidential
business information;
(d) the
information was collected during
an inspection, investigation or
for a legal proceeding;
(e) the
disclosure of the information
might result in that type of
information no longer being
supplied and it is reasonable
that the type of information be
supplied;
(f) the
information was collected in
relation to a complaint by one
of OMVIC’s complaint
representatives; or
(g) the
information is subject to
solicitor/client privilege.
4.7.9 If OMVIC
is reasonably able to sever the
information contained in the
above exceptions from a
requested record, access to the
remainder of the information in
the record will be provided.
4.7.10 OMVIC
will refuse access to all or
part of an applicant’s personal
information in the following
situations:
(a) the
disclosure of the information
could reasonably be expected to
threaten the life or security of
another individual
(b) the
disclosure of the information
would impair or disclose the
existence of an inspection,
investigation, enforcement or
legal proceedings under the MVDA
or any other Act;
(c) the
information would reveal
personal information about
another individual; or
(d) the
information would identify the
individual who gave an opinion
about another individual and the
individual giving the opinion
does not consent to the
disclosure of his or her
identity.
4.7.11 If we
are reasonably able to sever the
information contained in the
above exceptions from a
requested record, we will give
access to the remainder of the
information in the record.
4.7.12 OMVIC
will inform the applicant if he
or she will be given access to
all or part of his or her
personal information. If access
is to be given, OMVIC will
inform the applicant of when
access will be given. If access
to all or part of the
applicant’s personal information
is refused, OMVIC will inform
the applicant of the reason(s)
for refusal. OMVIC will also
inform the applicant of the name
of the person in our
organization who can answer
questions regarding the refusal.
4.7.13 If an
individual believes that his or
her personal information in
OMVIC’s custody or under OMVIC’s
control has a mistake in it or
is missing some information, he
or she may request that OMVIC
correct the information.
4.7.14 If
OMVIC decides that the
information should be corrected,
it will be done as soon as
reasonably possible.
4.7.15 If
OMVIC decides not to correct the
information, a note will be
placed on the individual’s
personal information indicating
that a correction was requested.
4.7.16 OMVIC
will not correct or change an
opinion, including a
professional or expert opinion.
OMVIC will make a note on the
individual’s personal
information indicating that a
correction was requested.
4.8 Accuracy
4.8.1 OMVIC
will make its best efforts to
ensure that personal information
used or disclosed by OMVIC or
its agents is sufficiently
accurate, complete and
up-to-date to minimize the
possibility that inappropriate
information may be used to make
a decision about a registrant or
applicant.
4.8.2 OMVIC
will update personal information
about registrants as and when
necessary to fulfill the
identified purposes or upon
notification by the individual.
4.9 Protection
4.9.1 OMVIC
will use reasonable security
safeguards to protect personal
information against such risks
as loss or theft, unauthorized
access, disclosure, copying,
use, modification or
destruction.
4.9.2 OMVIC
will protect personal
information using physical,
administrative and technical
safeguards that are appropriate
to the sensitivity of the
information.
4.10 Retention
4.10.1 OMVIC
will keep personal information
only as long as it remains
necessary or relevant for the
identified purposes or as
required by law.
5. PROCEDURE FOR HANDLING
ACCESS & PRIVACY COMPLAINTS
5.1 An individual who
believes that OMVIC has not
complied with this Code may make
a written complaint about the
matter to our organization.
OMVIC will use its internal
complaint handling procedure to
examine and attempt to resolve
the matter. The complaint must
be in writing and addressed to
the Chief Privacy Officer (CPO).
The CPO will respond in writing
to the question of compliance
with the Code within a
reasonable time of the receipt
of the complaint.
5.2 OMVIC will provide the
complainant with a copy of this
Code, upon request.
5.3 OMVIC may decide not to
examine a complaint if:
(a) the
complaint relates to an act or
practice that is not a possible
breach of the privacy of an
individual;
(b) the
complaint relates to an act or
practice that is no longer
reasonably able to be
investigated because of the
length of time since it
occurred;
(c) the act or
practice relates to an event
which occurred prior to the
organization being subject to
this Code;
(d) the
complaint is trivial, frivolous
or vexatious; or
(e) the
complaint relates to an act or
practice that is the subject of
court or tribunal proceedings
that have commenced or are
intended to be commenced.
5.4 With the exception of
complaints that OMVIC has
decided not to investigate as in
Article 4.3, OMVIC will
investigate and respond to all
complaints within a reasonable
period of time. If the complaint
is found to be justified, OMVIC
will take appropriate steps to
resolve the complaint including,
if necessary, amending our
policies and procedures or this
Code.
5.5 A complainant will be
expected to provide full details
of how the complaint arose,
including the identification of
the parties involved, if known,
copies of any relevant
documentation and reasons why
the complainant believes his or
her privacy may have been
breached.
5.6 OMVIC will inform the
complainant of the outcome of
the investigation regarding his
or her complaint.
6. MONITORING/REVIEWING THE
OPERATION OF THE CODE
6.1 OMVIC will monitor
compliance with this Code.
6.2 OMVIC’s Executive
Director will appoint a person
to review this Code at regular
intervals to ensure that the
Code is still serving its stated
purposes; that it is being
complied with; that the internal
complaint handling procedure is
still effective; and to
determine if there are any
amendments that should be made
to improve the operation of the
Code.
7. CONTACT INFORMATION
The individual charged with
the responsibility for OMVIC’s
Access and Privacy Code is the
Chief Privacy Officer. The CPO
may be contacted at:
Michael Rothe
Counsel & Chief Privacy Officer
Ontario Motor Vehicle Industry
Council
800-789 Don Mills Road
Toronto, ON M3C 1T5
Phone:
416-512-3165
Fax: 416-512-3758
Toll Free: 1-800-943-6002 ext.
3165
E-mail:
privacy@omvic.on.ca
|
