PRIVACY PROTECTION FOR THIRD PARTIES
1. SUBJECT MATTER AND SCOPE:
Privacy is important for Aéroports de Montréal (“ADM”). This Policy on the protection of personal information regarding ADM’s customers (the “Policy”) is designed in such a way as to comply with Canadian statutes governing the protection of personal information and aims to describe the practices followed by ADM respecting the collection, use, management and disclosure of personal information concerning individuals who seek to become, are or were ADM customers.
The Policy applies to personal information held by ADM or under its control, including information communicated to third parties for storing or processing purposes. However, the Policy does not apply to personal information concerning ADM’s employees, with respect of whom a separate policy has been adopted.
“personal information”: information concerning a natural person, which allows for the identification of that person, irrespective of the nature of the support on which it is held and the form under which it may be accessed. The information concerning a legal person such as a company or a corporation does not constitute personal information.
“customer”: a person who uses or requests to use ADM’s products, services or facilities, namely its website, and any other application or communication or information exchange platform.
“third party”: a natural or legal person other than ADM, its employees or its customers.
3. OUR RESPONSIBILITIES:
Section 1: Accountability
The mandate to implement and enforce the Policy is entrusted to:
Vice President, Legal Affairs, Corporate Secretary
and Privacy Officer of ADM
It is also incumbent on the Privacy Officer to make decisions pertaining to the communication of personal information to the person concerned or his or her representatives, to ADM’s partners or collaborators or to third parties, including to the police or judicial authorities. Such decisions shall be made in compliance with applicable laws and the Policy.
In the event that the Privacy Officer is absent or in case of emergency where the Privacy Officer cannot be reached in a timely manner, the responsibility for the application of the Policy and decision making authority concerning the communication of personal information shall be exercised by the person to whom the Privacy Officer has delegated his authority in respect of privacy matters.
Section 2: Collection and use of personal information
Personal information which is collected namely includes information on your identity, such as your first name and last name, your residential address, your phone number, your e mail address and your passport number; financial information concerning you and your purchases, such as the method of payment used and the value of the goods and services purchased; information concerning your movements within the terminal, such as your use of the parking spaces and premises of ADM; your travelling information, such as your dates of departure and arrival, your destination, the number and locations of the stopovers, the duration of your stay and the airline company used; and information respecting your use of the Wi Fi network made available by ADM, such as periods of activity and the amount of data downloaded.
ADM also uses video surveillance and recording systems within its facilities. These systems are necessary to ensure the security and protection of the customers, employees and third parties, to prevent theft or losses and for investigation purposes following an incident or accident on site; they are intended to be reasonable, particularly having regard to the nature of the activities conducted by ADM.
In most circumstances, ADM collects personal information directly from you. However, ADM may also collect personal information about you from third parties with your consent, for instance, from airline companies, or without your consent if the law so authorizes, for instance when collecting the information is obviously in your interest and that your consent cannot be obtained in a timely manner.
ADM only collects and uses personal information which is necessary for the following purposes:
1. To provide products and services
For example, we may collect and use your address or your e mail address to send you by any appropriate means the products and services which you requested.
2. To process a payment associated to the use of our products, services and facilities
For example, we collect and use financial information to process the payments associated to your use of our parking lots.
3. To comply with our legal and regulatory obligations
For example, we may collect and use personal information to comply with a court order or for the purpose of reporting to governments.
4. To improve security and safety
For example, we use cameras to monitor the access, exit or activities conducted in the public areas and those restricted to authorized members of the public.
5. To improve the products, services and facilities we offer
For example, we conduct surveys on client satisfaction to improve our products, services and facilities.
6. To answer questions, comments and suggestions
For example, when questions are sent to us through the “Contact Us” page of our website,
7. To establish your identity
For example, we may request personal information, such as a photograph, to issue passes allowing persons to be identified in areas which are restricted to the authorized members of the public and obtain access to such areas.
8. To contact you through direct marketing
For example, we may use your coordinates to provide you with information on new products, services and facilities.
9. To improve your online experience
Your personal information will not be used for other purposes than those previously mentioned unless it is with your consent or in the cases and under the conditions provided by law.
Section 3: Communication of personal information
ADM recognizes that except in the cases described below and under the other conditions provided by law, the communication of personal information requires your consent when it is communicated to third parties.
In accordance with applicable law, for example, ADM may communicate your personal information without your consent in the following situations:
1. the communication is made to a lawyer – in the province of Quebec, to a lawyer or a notary – who represents ADM;
2. it is made for the purpose of collecting a debt;
3. it is required pursuant to a subpoena, warrant or order of a court, a person or a body having the power to compel production of information or required under rules of procedure pertaining to the production of documents;
4. it is made to a government institution – or a subdivision of such an institution – who requested the information by mentioning the source of the legitimate authority supporting its right to obtain it and the fact, according to the case, that:
(i) it suspects that the information is related to national security, the defence of Canada or the conduct of international affairs,
(ii) the communication is requested for the purposes of the control of the application of Canadian, provincial or foreign law, the conduct of investigations related to such control of application or the collection of information pertaining to security for the purpose of exercising this control of the application,
(iii) it is requested for the purposes of the application of Canadian or provincial law;
5. it is made, at the initiative of the organization, to an investigative body, a government institution or a subdivision thereof and the organization, according to the case, has reasonable grounds to believe that the information relates to the violation of an agreement or a breach of federal, provincial or foreign law which has been, currently is or is about to be committed or suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;
6. it is made to anyone who needs the information in case of an emergency jeopardizing the life, health or safety of any person and, where the person concerned by the information is still living, the organization shall inform that person in writing forthwith;
7. it is made for statistical purposes;
8. it is information of a regulatory nature, which the public may access;
9. it is required by law.
ADM may also share your personal information without your consent with its agents, mandataries, consultants, data managers and other service providers if such information is necessary for them to fulfill their mandates or service agreements. In all cases, the personal information concerning you will be used to provide specific services and be retained on a confidential basis in accordance to this Policy.
Section 4: Consent
For the consent to the collection, use and communication of personal information to be valid, the purposes must be stated in such a way as to enable the person to reasonably understand how the information will be used or communicated.
When you provide personal information to us, you consent to its use in the manner set out in the Policy and further clarified at the time it is collected. According to the nature and sensitivity of the personal information, your consent may be explicit, for example, by checking a box to indicate that you consent to the collection, use or communication of your personal information. Your consent may also be implicit, for example when the purposes behind the use of your personal information is reasonably apparent.
Subject to all the legal and contractual restrictions and reasonable prior notice, you may refuse to give your consent or withdraw such consent at any time. Refusal or withdrawal of your consent may however prevent ADM from providing you a product or a service or giving you access to some of its facilities.
You may refuse or withdraw your consent by contacting us at firstname.lastname@example.org. Our staff will explain to you your choices and the consequences resulting from your refusal or withdrawal of consent, and will note your choices in our files.
Section 5: Accuracy
ADM recognizes that it is important that the personal information concerning its customers is accurate, complete and up-to-date and, to this end, has implemented reasonable measures to ensure the accuracy and completeness of the information according to the purpose sought by its collection. However, it is incumbent on the customer to inform ADM of any significant change respecting his personal information during his business relationship with ADM.
Article 6: Archiving and protection measures
ADM implemented various means to ensure that your personal information is protected against the risk of loss and theft, as well as the risk of unauthorized access, communication, reproduction, use, modification or destruction. These means include physical, administrative and electronic (technological) means which are reasonable taking into account the degree of sensitivity of the personal information collected, the quantity, repartition, distribution and format of the personal information and the retention methods.
ADM reviews and updates on an ongoing basis the security measures implemented to protect the security and confidentiality of the personal information it holds, particularly technological measures to take into account technological evolution to counter the unjustified intrusion risks in its databases and computer systems.
ADM retains the personal information concerning you only for the time necessary to achieve the purpose for which it has been collected, to meet the legal requirements to which it is subject and for the time necessary to ensure the protection of its legitimate business interests.
ADM may process and archive your personal information in Canada or in the United States. Accordingly, the governments, courts, law enforcement organizations or regulatory bodies of Canada and the United States, according to the case, may have access to your information under the laws in force in the jurisdictions where the information is located.
ADM may also rely on third party service providers (for example, data hosting or payment processing providers) to ensure the management of one or several aspects of our business activities, including the processing or management of personal information. When we retain the services of an external company, we use contractual or other appropriate means to ensure that your personal information is protected in accordance with the law applicable to ADM and collected, used, retained and destructed in such a manner as to comply with the Policy. If a third party to whom ADM sends personal information about you operates in a foreign jurisdiction, the local legislation may allow the local authorities previously listed to also access your personal information without your consent.
Section 7: Access
Customers are entitled to have access to the personal information ADM holds concerning them. Requests for access must be sent in writing to the Privacy Officer, 800 place Leigh¬ Capreol, suite 1000, Dorval, Quebec H4Y 0A5 or by email at email@example.com.
In certain situations, according to applicable law, ADM may refuse to give you access to personal information concerning you. Here are some examples of such situations:
• the disclosure of this information reveals personal information concerning another person;
• the disclosure of this information reveals confidential business information;
• the information is covered by professional secrecy binding a lawyer to his client;
• the information has been collected in the context of an investigation respecting non compliance with an agreement or the violation of a federal or provincial statute.
If access cannot be granted to you, ADM will notify you in writing of the reasons for its refusal.
When personal information concerning you held by ADM is found to be inaccurate or incomplete, you may also submit to ADM a request for rectification by following the same procedure applicable to a request for access. If the information in question must be corrected, stricken out or completed, ADM will modify the information accordingly and, if required, send the modified information to the third parties having access to the information in question.
ADM undertakes to answer any request for access or rectification within 30 days from the date of receipt of the written request unless circumstances authorize ADM to extend the time to do so. In such a case, ADM will send to the person having made the request, within 30 days from the date of the request, an extension notice informing the person of the new time period and the reasons for the extension.
Access to your personal information is generally granted free of charge. However, ADM may, in accordance with applicable law, charge fees if it informs the person having made the request of the approximate amount of such fees prior to fulfilling the request.
Section 8: Review of the Policy
The Policies and procedures of ADM intended to ensure the protection of personal information are updated on an ongoing basis. Please consult the last version of the Policy on our website at www.admtl.com. A copy of the Policy may also be sent to you by mail upon written request to the Privacy Officer, 800 place Leigh-Capreol, suite 1000, Dorval, Quebec H4Y 0A5.
Section 9: Your questions and concerns respecting compliance with the Policy by ADM
Your questions and concerns respecting the Policy and compliance therewith by ADM and any complaint in that respect must be sent in writing to the Privacy Officer, 800 place Leigh-Capreol, suite 1000, Dorval, Quebec H4Y 0A5 or by email at firstname.lastname@example.org.
The Privacy Officer will investigate each written complaint he receives. If a complaint is justified, the Privacy Officer will take the necessary measures to settle it, including modifying the Policy or its procedures for ensuring the protection of personal information, if warranted. In each case, the complainant will be notified in writing of the results of the investigation.
The Privacy Officer reports each year to the board of directors of ADM on the number of complaints received in the preceding year, their nature and the measures taken in response to them.
For any general question respecting the federal regulations applicable to ADM respecting the protection of personal information in Canada or to obtain a copy of the Personal Information Protection and Electronic Documents Act, please contact the Office of the Privacy Commissioner of Canada at 112 Kent Street, Ottawa, Ontario K1A 1H3 or visit the website: www.privcom.gc.ca.
Last update: September 2015