Last Updated: March 19, 2025
Policy Statement
NWAC is committed to being accountable for how it handles Personal Information collected or obtained during the course of its research activities and for the principles outlined in this policy. The CEO is accountable for overall compliance with this policy but may delegate her authority to the Senior Management Team within their own purview. For instance, NWAC has various departments, which, for privacy reasons, may contain information, which is accessible only to certain NWAC Employees. As a result, requests for information may have to be directed to different Employees within NWAC.
Procedures
As an overall framework, NWAC’s privacy policy is guided by principles of Ownership, Control, Access and Possession (OCAP). The OCAP principles apply the concepts of self-determination and self- governance to research, statistics and information involving First Nations, Métis and Inuit communities.
Under OCAP principles, ownership refers to the relationship of a First Nation/ Métis/Inuit community to its cultural knowledge/data/information. OCAP states that a community or group owns information collectively in the same way that an individual owns his/her Personal Information.
The principle of control recognizes the right of First Nations/Métis/Inuit communities and representative bodies to control research and information management processes which affect them, including research projects, policies, processes, frameworks, etc.
Access refers to the right of First Nations/Métis/Inuit peoples to have access to information and data about themselves and their communities, wherever held, and to make decisions regarding access to their collective information.
Possession refers to the actual custody and stewardship of data, in other words, where information is actually held or stored.
OCAP principles recognize collective rights to control and access information, rather than only individual ones. Thus, NWAC requires that collective consent, at the community, tribal and/or regional level be obtained as well as the free and fully informed consent of the individual participant before information is collected, used, or distributed.
NWAC has also adopted certain principles, which were developed in the National Standard of Canada Model Code for the Protection of Personal Information. Along with informed consent, these include a requirement that the purposes for which Personal Information is collected are:
a) Documented, identifiable and limited to what is necessary;
b) That Personal Information is retained only as long as necessary to fulfill these purposes;
c) That it be accurate, complete, and up-to-date;
d) That it be protected against loss or theft, as well as unauthorized access or disclosure;
e) That privacy policies and practices relating to the management of Personal Information be accessible and available;
f) That an individual be informed of the existence, use, and disclosure of his/her Personal Information and provided access to it on request; and
g) That an individual be able to address a challenge concerning compliance to a designated and accountable individual. The following describes the principles in more detail.
What is Personal Information?
Personal Information means any information that could be used to identify someone, such as their name, address, telephone number, age, sex, marital status, education, social insurance number, race and ethnic origin, identification numbers, income, blood type, evaluations, Employee files, and health or medical records. This might include collective or communal information, in some instances, such as Band membership, tribal affiliation or language, to give some examples.
Limits on Collection, Use and Disclosure
NWAC collects many different kinds of Personal Information. For example, raw data is collected from individuals through questionnaires for research. Statistical information based on Personal Information may be gathered or received. Other information, such as historical or archival information containing Personal Information, may be collected in the course of research. NWAC also uses and receives “de- identified” information. This refers to Personal Information where all information, which might identify an individual, has been removed, or where the Personal Information has been coded, so that the identity of the person who provided it cannot be determined. In all instances, however, NWAC only collects and uses that Personal Information which is needed to fulfill the purposes identified in the work plan, research plan or research agreement which governs the specific research being done.
How Consent is Obtained?
NWAC’s policy is to have free and fully informed consent before Personal Information is collected. Informed consent means that the individual providing the information knows from the outset why their Personal Information is needed, what the purpose of the research is, how the information will be used, who the information will be shared with, how long it will be kept, and what will be done with it when it is no longer needed.
In seeking informed consent, NWAC considers both the sensitivity of the information and what a reasonable person would expect and consider appropriate in the circumstances when determining what form of consent to use. Individuals and communities will not be subjected to any undue pressure or influence when approached to participate in research activities and processes.
There are some circumstances in which NWAC may receive information in which it is impossible to obtain consent, for example, information that has been “de-identified,” or statistical or historical information. In those limited circumstances, NWAC will not be able to obtain consent for the collection, use or disclosure of information, as this would be impractical or even impossible. In all other circumstances, NWAC requires that individual consent is expressly given in writing, before Personal Information is collected, used or disclosed. NWAC requires that the consequences of withdrawing consent be explained at that time as well. Individuals will be given a chance to refuse to share their Personal Information. They will also be able to withdraw their consent to the use of their Personal Information at any time during the research process. If they choose to withdraw their consent, their Personal Information will be removed from the research database and will either be returned to them or destroyed.
Consent is a continuing process and ongoing consultation with community members and/or First Nation/Métis/Inuit citizens will be necessary at every stage of the process. If an individual b longing to a community, which has consented to participate in research later, withdraws their individual consent, their Personal Information will be removed from the research.
Retention and Security of Information
NWAC will only keep Personal Information for as long as it is needed to fulfill the purposes, which were identified at the time written consent was provided. This time period may vary, depending on the particular research involved. However, NWAC will not retain an individual’s Personal Information for a longer period of time without his/her further written consent.
If Personal Information has to be destroyed, reasonably secure methods are used, such as erasing electronic records and shredding paper records without keeping any copies. NWAC has security arrangements in place to prevent against risks such as unauthorized access, collection, use, disclosure, copying, modification or disposal of Personal Information. If NWAC retains an individual or an organization to do research that involves Personal Information, NWAC will ensure that there is a contractual or other agreement in place that commits the individual or organization providing services to comply with NWAC’s privacy policy. Much of the information in NWAC’s custody is electronic. NWAC’s electronic information is stored off-site and is protected by firewalls. It is also backed up regularly and is accessible only to authorized persons by password.
Disclosure of Personal Information
NWAC does not disclose Personal Information to outside agencies and will never sell or rent or lend Personal Information to Third Parties. In certain circumstances, NWAC may be required by law to disclose Personal Information without consent only, for example, due to a court order or a search warrant. Where Personal Information is used for research purposes such as publication and communication activities, Personal Information will be made anonymous (“de- identified”) and will remain confidential. In all cases, NWAC will take steps to ensure that the dissemination of information meets accepted research standards of ethics and protocols including NWAC’s own culturally based frameworks.
Access to Personal Information
Individuals have the right to access their own Personal Information at any point in the research project and process. They will also have access to descriptions of the research objectives and methods at all times. Where research is being conducted that is community or Nation-based, guidelines and procedures for access to data will be agreed upon with the relevant authorities representing the community or Nation participating in the research and will be outlined in the research plan.
Because of the sensitivity of Personal Information, requests by an individual for access to their own Personal Information must be made in writing to the CEO. NWAC may require that individuals prove their identity before giving them access. Where a request is made for information by an outside agency, NWAC may require that the request be made by an authorized official in writing, and on official letterhead.
On receiving a written request for Personal Information, NWAC will inform an individual what Personal Information NWAC possesses and will inform him/her how the information is being, or has been, used and the names of the individuals and organizations to which his/her Personal Information was disclosed. Requests for Personal Information will be answered as soon as reasonably possible after the written request is received.
There may be situations in which it is impossible to provide access, such as when information is “de-identified,” or where NWAC does not have custody or control of the information. If an access request is denied, the applicant will be informed of the reason why and will be informed of what further steps may be available to him or her.
Accuracy
NWAC makes reasonable efforts to ensure that Personal Information it collects, uses or discloses is accurate and complete at the time it is collected. On occasion, an individual may wish to correct errors in his/her Personal Information. Where it is reasonable to do so, corrections will be made. However, it may not be possible to correct information that was “de-identified,” or was published, or where NWAC does not have custody or control of the information. In such instances, individuals will be informed of why the information cannot be changed.
Open and Transparent
NWAC’s Privacy Policy is intended to be open, public and transparent.
Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
Native Women’s Association of Canada
Email: info@nwac.ca
Website: https://nwac.ca