Forum Research's Commitment to Privacy
At Forum Research, we know that without the cooperation of respondents, we could not be in business. Our longstanding commitment to safeguarding your right to privacy is the reason for our reputation as a leader in the protection of privacy. Each year, we ensure that our employees sign a code of business conduct that requires the safeguarding and proper use of personal information. We also place strict controls on the protection and use of personal information within our systems and web site and ensure that our employees are trained to respect your privacy at all times.
Any time you have contact with our company, or with anyone acting as an agent on our behalf, you are protected by the rights and safeguards contained in the Policy.
We take all of the necessary precautions to ensure the safeguarding of your information, whether it is stored electronically or in paper format. In all cases, information is retained in secure facilities, protected from unauthorized access and kept only as long as is reasonably required. For example, our electronic files are backed up for redundancy, password protected and accessible only by authorized employees, on a need-to-know basis.
To ensure our commitment to your privacy is upheld, we have updated our existing company policies setting out your rights and our obligations respecting the treatment of your personal information by our company. Our company policies comply with the requirements of the Personal Information Protection and Electronic Documents Act as well as the standards of the Canadian Research Insights Council (CRIC)..
Employees and Agents
Personal information is information about an identifiable individual. Publicly available information, such as a public directory listing of your name, address, telephone number, electronic address, is not considered to be personal information.
Collecting Information Helps Our Clients Serve You Better
We collect personal information only for the following purposes:
- to help our clients establish and maintain responsible commercial relations with you and provide you with ongoing service;
- to help our clients understand your needs and eligibility for products & services;
- to help our clients recommend particular products & services to meet your needs;
- to help our clients develop, enhance, market or provide products and services;
- to help our clients manage and develop their business and operations, including personnel and employment matters; and
- to help our clients meet legal and regulatory requirements.
Your personal information will not be used for any other purpose without your consent.
Use of 'Cookies'
Protection of Children
As an added protection for children, on any of our services directed to children under 13 years of age, we will obtain the permission of a parent or legal guardian before collecting, using or disclosing any personally-identifiable information about a child, e.g., for participation in a survey.
Do Not Call
If you've been called by us to do a survey and don't wish to participate in this survey, please click here to have your telephone number taken off the calling list for this survey.
Limiting the Collection, Use & Disclosure of Personal Information
The collection of personal information shall be limited to that which is necessary for the identified purposes. Personal information shall not be collected indiscriminately, and only by fair and lawful means, without misleading or deceiving you about the purposes for collection, and without deception in obtaining consent.
Forum Research will collect personal information directly from individuals only for purposes that are reasonable and will only collect information that is reasonable for carrying out those purposes. Personal information collected will be limited to what is necessary to carry out our obligations to the client.
Retention, Archiving & Destruction of Personal Information
Forum Research has established information retention guidelines that define consistent minimum standards and requirements for the length of time client information are to be maintained.
We have established appropriate practices for the timely and secure disposal - consistent with confidentiality, legal and regulatory requirements.
Forum Research is responsible for the storage/retention of research data, at minimum for the length of its contract with a custodian or as required by regulatory bodies, whichever is greater.
A research project or activity should be regarded as having ended after (a) final reporting to the research sponsor, (b) final financial closeout of a sponsored research award, or (c) final publication of research results, whichever is later.
Ensuring Safeguards for Personal Information
Forum Research will protect the safety and respect the confidentiality of personal information through appropriate safeguards, as per Information Security & Appropriate Use of Technology policy.
We take all of the necessary precautions to ensure the safeguarding of information, whether it is stored electronically or in paper format. In all cases, information is retained in secure facilities, protected from unauthorized access and kept only as long as is reasonably required. Electronic files are backed up for redundancy, password protected and accessible only by authorized employees, on a need-to-know basis.
We conduct thorough risk self-assessments once every two years to identify privacy threats and vulnerabilities, determine risks, and recommend appropriate control measures.
Employee Training & Awareness
Forum Research employees are aware of the importance of maintaining the confidentiality. As a condition of employment, all new employees/agents sign a Confidentiality Agreement. This safeguard may also be facilitated through contractual provisions. Additionally, employee, contractors, and volunteers’ access to sensitive information are restricted as much as possible and we review access logs regularly.
Ongoing education efforts are delivered to ensure employees, agents, and third parties are provided with tools, training and support as appropriate to enable them to fulfill their duties.
Forum Research is constantly monitoring adherence to this policy using a risk-based model, and report to the appropriate governance bodies.
Accountability for compliance with this policy rests with the President and Chief Executive Officer. In addition, other individuals within the company are delegated to act on behalf of the Chief Executive Officer, such as the Senior Vice-president and Chief Information Officer or the designated privacy contact person, the Enterprise Privacy and Access Officer.
Breaches of this policy and related privacy policies may be subject to disciplinary action, as outlined in the Confidentiality Agreement.
Forum Research and its agents are also subject to the fines and penalties set out in PHIPA: up to $50,000 for individuals and $250,000 for the organization, and PIPEDA: up to $10,000 on summary conviction or up to $100,000 for an indictable offence.
Privacy Incidents and Breaches
In the event of a privacy breach, the management staff responsible must immediately inform the Enterprise Privacy and Access officer. In addition, any employee, consultant, volunteer, and contractor may approach the EPAO directly at any time to raise concerns, ask questions, request information, or make complaints relating to data protection or data security issues.
Violations and infractions relating to privacy issues are documented, and appropriate sanctions are made in accordance to this policy.
We undertake the following steps when responding to a privacy breach:
- Breach Containment
- Risk evaluation, including identification of information involved, cause and extent of the breach, individuals affected, and foreseeable harm resulting from the incident
- Notification of all affected parties
- Prevention of future reoccurrence
Decisions made by the Enterprise Privacy and Access Officer to remedy data protection breaches must be upheld by management.
1. Enterprise Privacy and Access Officer (EPAO)
- Enterprise governance, framework, strategy
- Development of enterprise policies, procedures, controls, standards
- Reporting and escalation to senior management team/board
2. Management / Supervisor
- Comprehend and adhere to this policy
- Develop operating procedures/practices within department (including supporting documentation that support this policy)
- Know where the policies/supporting tips are published
- Ensure staff, consultants, contractors, and volunteers are knowledgeable of policies, standards and procedures
- Ensure that EPAO is aware of all the technologies that are being utilized for storing and transporting sensitive information
- Monitor employees daily for privacy compliance as well as quality assurance and information accuracy purposes
3. Employees, Consultants, Contractors, and Volunteers
- Comprehend and adhere to this policy and supporting departmental procedures
- Know where the policies/supporting tips are published
- Only use technologies that are supported by FRI policies
- Ask questions when unsure of a policy or procedure
There are 10 aspects to our evidence to support that all data shall be stored within Canada, remain in Canada, and be accessible only within Canada:
- We are 100% Canadian-owned, so we are not subject to non-Canadian ownership impacts.
- We have no non-Canadian affiliates or subsidiaries.
- All staff with access to our data centres are Canadian citizens.
- We operate our own Canada-based data centre (at 180 Bloor St. W., Suite 1400, Toronto, ON M5S 2V6). All data is backed-up to our Montreal data centre (at 355, rue Sainte-Catherine Ouest, bureau 400, Montréal, QC H3B 1A5)
- We manage and fortify our own data vault at our data centres.
- We do not store any data anywhere other than in our own data vault.
- We do not use any cloud services.
- We only use Canadian IT vendors. companies operating on Canadian infrastructure.
- All of our servers are located on-site in a secure server room at our headquarters in Toronto, Ontario.
Most importantly, the data for this project will not be accessible outside our premises unless we specifically initiate the access; and when this access is initiated, it is on a one-time basis with the previous approval of our client.
Forum Research utilizes one third-party service provider that is fully monitored and audited for privacy. Third-party access is restricted as much as possible and third-party access logs are reviewed on a regular basis. Upon client request, highly sensitive data is encrypted using an encrypting file system (EFS).
No personal information provided by the client or respondents, is shared with third parties within or outside Canada.
Agent: A person that, with the authorization of FRI, acts for or on behalf of the organization in respect of personal health information for the purposes of FRI and not the agent’s own purposes, whether or not the agent has the authority to bind the custodian, whether or not the agent is employed by FRI and whether or not the agent is being remunerated. Examples of agents of FRI include, but are not limited to, employees, volunteers, consultants, researchers.
Confidential information: Confidential information maintained at FRI can fall under three categories, Personal Health Information, Personal Information, and Corporate Confidential Information.
Corporate confidential information (CCI): Information maintained by FRI that is not routinely made publicly available, including financial, administrative, commercial and technical information, and can also include records containing legal advice and employee-related information. These records may be subject to the Freedom of Information and Protection of Privacy Act (FIPPA).
Health information custodian (Custodian): Listed persons or organizations under the Personal Health Information Protection Act, such as hospitals, who have custody or control of personal health information as a result of the work they do.
Personal health information (PHI): Any identifying information about an individual related to the individual’s health or to the provision of health care to the individual. For example, an individual’s health number and/or medical record would be considered personal health information, subject to the Personal Health Information Protection Act (PHIPA).
Personal information (PI): Identifying information about an individual that does not contain health care information. Examples include an individual’s age, religion, address and telephone number. Records that contain PI may be subject to the Freedom of Information and Protection of Privacy Act (FIPPA).
Record of personal health information: The Personal Health Information Protection Act defines a record as personal health information in any form or in any medium, whether in written, printed, photographic or electronic form or otherwise.
Forum Research will make specific information about its policies and practices relating to the management of personal information readily available.
An individual will be able to address a challenge concerning compliance with this policy.
We will inform individuals who make inquiries or lodge complaints of the existence of relevant complaint procedures. We will investigate all complaints. If a complaint is found to be justified, we will take appropriate measures, including amending its policies and practices if necessary.
Any exceptions to this policy must be approved in advance by the Enterprise Privacy and Access Officer and may require the involvement of other groups. The Forum Research Inc. main office may be contacted to initiate the request, by phone at 416-960-9600 or by email to firstname.lastname@example.org.
Any exceptions to related policies must be approved in advance by their respective owners.