In August 2000, the Director Military Family Services (DMFS) developed the Privacy Code for Military Family Services Program (the Code) to assist Military Family Resource Centres (MFRCs) in protecting the personal information of Canadian Forces (CF) members and their families that is provided to or collected by MFRCs located within Canada

The Code establishes the standard under which MFRCs within Canada collect and use personal information about Canadian Forces (CF) members and their families.  Use of personal information, including nominal roll information provided directly by the CF when a member is posted or deployed is necessary for the provision of mandated services to members and their families.  Personal information is also collected from MFRC employees, volunteers and third parties that provide services such as child care and will be similarly protected. 

The Privacy Code for Military Family Services Program is a tailored version of the CSA Model Code for the Protection of Personal Information - CAN/CSA-Q830-96.  The CSA Code became a national Standard of Canada in 1996.  The 10 principles contained within the CSA Code reflect universal fair information practices that combine individual privacy rights with strong obligations to protect personal information collected and used by organizations.

For more information on the Privacy Code for Military Family Services Program and its application, please contact:

            Director Military Family Services
            Canadian Forces Personnel Support Agency
            245 Cooper Street
            Ottawa ON
            K2P 0G2 

Principle 6
 

Definitions   (Back to the top)

Collection – the act of gathering, acquiring, or obtaining personal information from any source, including third parties, by any means. 

Consent – voluntary agreement with what is being done or proposed.  Consent can be either express or implied.  Express consent is given explicitly, either orally or in writing.  Express consent is unequivocal and does not require any inference on the part of the MFRC.  Implied consent arises where consent may reasonably be inferred from the action or inaction of the individual. 

Deployment –the relocation of forces or individuals to desired areas of operation, exclusive of normal training or exercises. 

Director – refers to the Executive Director of a Military Family Resource Centre (MFRC) located within Canada.  

Director Military Family Services (DMFS) – the Directorate within DND/CF that has an oversight role with respect to an MFRC’s compliance with this Code.  

Disclosure – making personal information available to others outside the MFRC. 

Member/family – is a member of the CF, or the spouse, parent or child, or those in a dependency relationship with the member.  

Military Family Resource Centre (MFRC) – includes, for the purposes of this Code, only MFRCs located within Canada.  Any personal information concerning members/families collected, used, or disclosed by Canadian Military Family Resource Centres (CMFRCs) located outside of Canada is subject to the federal Privacy Act.   

MFRC staff - for the purposes of this Code, MFRC staff includes both paid employees and volunteers. 

Nominal roll information – information about a member of the CF that includes a member's name, home address and home telephone number by base/unit.  The CF provides this information to an MFRC when a member is posted or deployed. 

Personal information – information about an identifiable individual (e.g. CF member/family, MFRC staff or a third party) that is recorded in any form.

Use – refers to the treatment and handling of personal information within an MFRC.

Principals in Summary  (Back to the top)

Principle 1 - Accountability  
MFRCs are responsible for personal information under their control.  The Director of an MFRC shall be accountable for the MFRC's compliance with the following principles. 

Principle 2 - Identifying Purposes
The MFRC shall identify the purposes for which personal information is collected at or before the time the information is collected. 

Principle 3 - Consent  
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. 

Principle 4 - Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by the MFRC.  Information shall be collected by fair and lawful means. 

Principle 5 - Limiting Use, Disclosure, and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.  Personal information shall be retained only as long as necessary for the fulfillment of those purposes. 

Principle 6 – Accuracy  
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. 

Principle 7 – Safeguards
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information. 

Principle 8 – Openness
MFRCs shall make readily available to individuals specific information about policies and procedures relating to the management of personal information. 

Principle 9 - Individual Access
Upon request, a member/family, MFRC staff or third party shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.  An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. 

Principle 10 - Challenging Compliance
A member/family, MFRC staff or third party shall be able to address a challenge concerning compliance with the above principles to the Director of an MFRC who is accountable for the MFRC's compliance.
Challenging Compliance form

Principle 1 - Accountability  (Back to the top)
MFRCs are responsible for personal information under their control.  The Director of an MFRC shall be accountable for the MFRC's compliance with the following principles. 

1.1    Accountability for the MFRC's compliance with the principles rests with the Director, even though other MFRC staff may be responsible for the day-to-day collection and processing of personal information.  In addition, MFRC staff may be delegated to act on the Director's behalf. 

1.2     The MFRC is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing.  The MFRC shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.  

1.3     MFRCs shall implement procedures as outlined in the Application Guide to the Privacy Code for Military Family Services Program to give effect to the principles, to include: 

(a)     implementing procedures to protect personal information; 

(b)     implementing procedures to receive and respond to complaints and inquiries about adherence to this Code; 

(c)     training staff and communicating to staff information about the principles and the accompanying procedures; and 

(d)     developing information to explain the principles and the accompanying procedures.

Principle 2 - Identifying Purposes  (Back to the top)
The MFRC shall identify the purposes for which personal information is collected at or before the time the information is collected.  

2.1     The MFRC shall document the purposes for which personal information is collected in order to comply with Principle 8 – Openness and Principle 9 – Individual Access. 

2.2          Personal information about members/families is usually collected from several sources.  Nominal roll information as defined under this Code (see Definitions section) is transferred to MFRCs by the CF solely to communicate with a member/family when a member is posted or deployed. The consent of the member/family is not required to transfer nominal roll information to an MFRC.  Other personal information about members/families, staff or third parties may be collected directly by the MFRC.  However, the knowledge and consent of the member/family, staff or third party is required for the use and/or disclosure of this information (see Principle 3 – Consent). 

2.3          The identified purposes for collecting all personal information except nominal roll information shall be specified at or before the time of collection to the member/family, staff or third party from whom the personal information is collected.  Depending upon the way in which the information is collected, this can be done orally or in writing.  An application form or registration form, for example, may give notice of the purposes. 

2.4     When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use.  Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose. 

2.5     Persons collecting personal information shall be able to explain to individuals the purposes for which the information is being collected. 

Principle 3 - Consent    (Back to the top)
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.   
Note: In certain circumstances personal information can be collected, used, or disclosed without the knowledge or consent of the individual.  For example, legal, medical, or security reasons may make it impossible or impractical to seek consent.  When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information.  Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated.   

3.1     Consent is required for the collection of personal information and the subsequent use or disclosure of this information.  Typically, the MFRC will seek consent for the use or disclosure of the information at the time of collection.  In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use, for example, when the MFRC wants to use existing information for a new purpose not previously identified. 

3.2     The principle requires "knowledge and consent''.  MFRCs shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used.  To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.  

3.3     The MFRC shall not require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfill the explicitly specified and legitimate purposes.  Consent shall not be obtained through deception, for example, by misleading an individual about the true purposes for information collection, use or disclosure. 

3.4     The form of the consent sought by the MFRC may vary, depending upon the circumstances and the type of information.  In determining the form of consent to use, MFRCs shall take into account the sensitivity of the information.  Although some information (for example, medical records and income records) is almost always considered to be sensitive; in fact, any information can be considered sensitive, depending on the context.