Privacy Code
OCAS is committed to protecting your privacy. This Privacy Code informs you of the privacy principles that OCAS adheres to in providing services to the general public and to and on behalf of Ontario colleges and other post-secondary educational institutions.
1. Accountability
OCAS takes responsibility for all personal information under its control, including personal information transferred to its service providers.
OCAS has a privacy officer who supports its compliance with this Code and all applicable privacy and anti-spam legislation.
OCAS employees and contractors may only access, use and disclose personal information as authorized and must abide by organizational policies and procedures that support privacy protection.
2. Notification and transparency
When OCAS collects personal information it notifies individuals of its purposes in clear terms. OCAS also maintains a Privacy Statement to provide additional information about how OCAS collects, uses and discloses personal information.
3. Authorization
OCAS collects, uses and discloses personal information only as authorized.
Consent is one form of authorization upon which OCAS relies. OCAS may also be authorized to process personal information on behalf of colleges and other public bodies who may lawfully collect personal information because the collection of personal information is necessary to their activities.
Individuals may ordinarily withdraw their consent, though this may impede OCAS’s ability to provide application services or other services. OCAS informs individuals of the implications of withdrawing consent upon request.
4. Limiting collection of personal information
OCAS only collects personal information that is necessary for lawfully authorized activities, and only collects personal information by fair and lawful means.
OCAS collects personal information from third-parties as authorized by individuals or as an agent for colleges and other public bodies who are required or permitted by legislation to share personal information with each other.
5. Limiting use, disclosure and retention of personal information
OCAS does not use or disclose personal information for purposes other than those for which it was collected, except with individual consent, or as required or permitted by law.
OCAS has a records retention policy that specifies the length of time that records are maintained.
6. Keeping personal information accurate
OCAS takes reasonable steps to ensure that personal information is not used unless it is accurate and up to date. OCAS encourages individuals with existing accounts to review and update their profile information prior to making a new application.
7. Safeguarding personal information
OCAS protects personal information with security safeguards appropriate to the sensitivity of the information. This includes protection against loss or theft as well as unauthorized access, disclosure, copying, use or modification and includes protection against inadvertent damage or destruction.
OCAS employees and contractors must abide by the “need to know” principle, only accessing personal information as reasonably necessary for meeting their job responsibilities.
In working with service providers who handle personal information on its behalf, OCAS takes reasonable steps to choose service providers that are capable of keeping personal information safe, enters into contractual agreements with service to endeavour to keep personal information safe and takes reasonable steps to administer its relationships with service providers to endeavour to keep personal information safe.
8. Being open about policies and procedures
OCAS publishes a Privacy Statement and makes other information about how it protects personal privacy reasonably available upon request.
9. Providing access to personal information
Individuals have routine, account-based access to their profile, their applications and their activity history. Individuals with concerns about inaccurate account information may contact the OCAS privacy officer at privacyofficer@ocas.ca.
OCAS otherwise addresses access and correction requests on a case-by-case basis, as reasonable and as required by law. All such requests should be directed to the OCAS privacy officer at privacyofficer@ocas.ca. Depending on the nature of the request, it may be appropriate for OCAS to refer individuals to one or more colleges, the Ministry of Training Colleges and Universities or another public body.
10. Challenging compliance
Individuals with privacy concerns may make an inquiry or complaint by contacting the OCAS privacy officer at privacyofficer@ocas.ca. OCAS has procedures to receive and respond to inquires and complaints, and will take appropriate measures in response to valid concerns about its policies and practices.
Last revised: September 2020
