1. Definitions

In this policy:

• “Act” refers to relevant privacy and data protection legislation applicable in Saskatchewan, Canada.
• “Authorized Personnel” means any employee, faculty member, or staff member of the Academy of Fashion Design (AFD) whose job responsibilities require regular or occasional access to Personal Information held by the Academy.
• “Members of the AFD Community” or “Member” refers to all employees, faculty, staff, agents, contractors, or entities acting on behalf of the Academy.
• “Personal Information” refers to information about an identifiable individual that is recorded in any format, as defined under applicable privacy laws.
• “Third Party” refers to individuals, groups, or organizations, other than the Academy or the person to whom the information pertains, who may access Personal Information.
• “Request” means an application for access to records held by the Academy under the provisions of the Act.

2. Freedom of Information

• Individuals have the right to access records held by the Academy, subject to specific exemptions under the Act.
• Access to certain records may be subject to fees as specified by regulations.
• The Academy will continue to provide access to publicly available information without requiring formal requests where appropriate.

3. Protection of Privacy

a) Collection of Personal Information

The Academy will only collect Personal Information under the following conditions:

• When necessary for the proper administration of its educational programs, services, or operations.
• When explicitly authorized or required by Canadian federal or Saskatchewan provincial law.
• For legal enforcement or compliance purposes.

Personal Information will be collected directly from the individual concerned unless obtaining it from another source is justified by the circumstances. Members responsible for collecting such information will provide clear reasons for its necessity.

b) Safeguarding Personal Information

• The Academy will implement reasonable measures to protect Personal Information from unauthorized access, use, disclosure, or destruction.
• Access to Personal Information is limited to Authorized Personnel who require it for legitimate purposes as defined in sections 3(c) and 3(d).
• Information will be stored securely, either in locked physical locations or electronic systems protected by user authentication.

c) Use of Personal Information

The Academy may use Personal Information only for:

• The purpose for which it was collected.
• Other uses permitted by law.
• Uses explicitly consented to by the individual.

d) Disclosure of Personal Information

Personal Information will only be disclosed to Third Parties:

• For the purpose for which it was collected or for a compatible purpose.
• As required by law.
• With explicit consent from the individual or their authorized representative.

e) Access and Correction of Personal Information

• The Academy will strive to ensure that all Personal Information it holds is accurate and complete for its intended purposes.
• Individuals have the right to access their Personal Information, subject to any legal exemptions.
• If an individual believes their information is incorrect, they may request corrections, which will be reviewed and updated as necessary.

f) Retention and Disposal of Personal Information

• Personal Information will be retained based on the Academy’s retention schedule.
• Information deemed of historical value will be preserved permanently, while all other information will be securely destroyed when no longer needed.
  • Paper records: Destroyed by shredding or pulping.
  • Electronic records: Deleted in a way that prevents recovery.

g) Outsourcing and Third-Party Access

• The Academy may engage external contractors to assist in its operations. Any third party with access to Personal Information must comply with this policy and applicable privacy laws.

4. Responsibilities

• Chief Privacy Officer: The designated official responsible for compliance with privacy laws and this policy.
• Privacy Coordinators: Appointed within departments to handle freedom of information and privacy matters, in consultation with the Chief Privacy Officer.

5. Non-compliance

The Academy may take the following actions against anyone violating this policy or applicable privacy laws:

• Legal action, which may include criminal or civil proceedings.
• Disciplinary action for students, faculty, or staff, up to and including termination.

6. Procedures

The Chief Privacy Officer, in consultation with relevant departments, may establish procedures to ensure compliance with this policy. Guidance on applying the policy can be sought from the Chief Privacy Officer.