Policy regarding the protection of the personal information of individuals working for the Producer
Entry into force: September 1, 2023
1. Subject matter and scope
KO Group and its subsidiaries (KOTV, KO Distribution, KO24, KOScène) (hereinafter the “Producer”) agrees to process the personal information of persons working for it in compliance with the Act respecting the protection of personal information in the private sector. This Policy regarding the protection of the personal information of individuals working for the Producer (hereinafter the “Policy”) informs individuals working for the Producer of its practices regarding the collection, use, and disclosure of their personal information as well as their rights in relation to their personal information.
This Policy applies to all persons working for the Producer (hereinafter referred to as the “Designated Persons”).
2. Definition of “personal information”
In this Policy, the term “personal information” means any information that relates to a natural person and allows, directly or indirectly, to identify that person.
3. Collecting personal information
The Producer collects personal information about the Designated Persons that is necessary for the management of its working relationships with them. The Producer may collect the following personal information about the Designated Persons:
- Identifiers and contact information, such as their names, email and postal addresses, telephone numbers, government-issued identification documents (such as social insurance numbers, visa and passport information), and work/residence permits.
- Demographic information, including dates of birth, gender, citizenship or medical information. In some cases, the Producer may collect demographic information related to an equity, diversity and inclusion program, on a voluntary basis (this may include information related to ethnicity, sexual orientation, etc.).
- Professional and employment-related information, including title and compensation history, work schedule and professional status, work experience, education, permits and other titles, benefit and leave information, information about any problems or disputes that may arise, performance reports and evaluations, psychometric test results, disciplinary records, termination date and reasons (voluntary or involuntary and details) for termination.
- Financial information, such as that provided by persons working for the Producer for payroll management purposes (financial institution and bank account number) and information required to issue tax forms.
- Information about their emergency contacts, such as their names, contact information, and the nature of their relationship with them.
- Information that the Producer collects on use of the Internet, of its networks, of its devices, and of its premises, such as their IP addresses (if they can be used to identify the employees) and their device identifiers (for example, if the employee connects to the Producer’s Wi-Fi network). The Producer may collect information about the Designated Persons’ use of their work email account, of the Internet, of computers, of telephones, and of other devices of the Producer to which they have access in the course of their work. The Producer may also collect information about the Designated Persons’ use of their personal devices as part of their work. The Producer may also collect video images and photos using closed circuit video cameras.
- Other information, such as information they may provide through the payroll management system.
4.
Retaining and destroying personal information
The Producer shall use appropriate control measures and mechanisms to protect the Designated Persons’ personal information. These measures include restricting physical access to the Producer’s offices and records; restricting unauthorized access, disclosure, use and mishandling of personal information in the Producer’s possession and control; storing archival documents with trusted third parties in secure premises; and using firewalls, passwords, and file encryption for online activities.
The Producer’s objective is to prevent any form of unauthorized access, loss, misuse, sharing, or modification of personal information in its possession. The Producer also uses these safeguards when deleting or destroying the Designated Persons’ personal information.
The Producer endeavours to retain its personal information in Quebec or, when this is not possible, in Canada. However, the information stored on the servers of the Producer’s service providers may be located outside of Canada and may therefore be subject to the laws of that country, including any laws that allow government authorities to access it. Subject to these foreign laws, the Producer will, to the best of its ability, use contractual measures to maintain protections that provide the personal information with safeguards at least equivalent to those applicable in Quebec.
The Producer retains the Designated Persons’ personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, or as permitted or required by the Act respecting the protection of personal information in the private sector. Once no longer required, personal information is securely destroyed or anonymized in accordance with the Act respecting the protection of personal information in the private sector.
The following periods for the retention of the Designated Persons’ personal information are considered reasonably necessary:
- In perpetuity for documents containing rights of use, copyrights, related rights, or any other rights necessary for the exploitation of a work (e.g., contracts with writers, directors, performers, etc.);
- Seven (7) years following the completion of a project for which a person worked for the Producer for tax documents;
- Three (3) years following the completion of a project for which a person worked for the Producer for all other personal information.
5. Using personal information
The Producer uses the Designated Persons’ personal information for the purposes of managing its working relationships and for other legitimate purposes detailed in this Policy, as well as for other purposes permitted by the Act respecting the protection of personal information in the private sector.
For example, the Producer may use the Designated Persons’ personal information for the following purposes:
- To administer staff, including verifying the identity of the persons working for the Producer; managing taxes and social security; planning schedules and checking attendance and hours worked; implementing emergency contact information; and handling requests from Designated Persons in relation to their work;
- To manage and process benefits, including determining the eligibility of persons working for the Producer and their dependants and beneficiaries;
- To administer pay, sick pay, and leave;
- To assess performance, including making decisions regarding assignments, training, compensation, and promotions;
- To take the necessary measures in order to protect the health, safety, and physical and mental integrity of the Designated Persons;
- To administer internal business activities, including implementing disaster recovery, business continuity or other similar emergency plans and procedures; conducting internal reviews, audits and investigations; creating statistics and analytical tools for legitimate business purposes (such as improving business processes and managing the Producer’s staff);
- To prepare and manage work visa applications;
- To comply with legal and regulatory obligations, meet security requirements, and for fraud management purposes, including internal investigations, failure to perform tasks, and violation of a work contract, including by monitoring the use of the Producer’s information technology systems.
In addition to the purposes described above, the Producer may also collect personal information from the Designated Persons for any other purpose, with their consent, when required by the Act respecting the protection of personal information in the private sector.
The Producer may only make available to persons working for it the personal information of other Designated Persons, to the extent necessary for the performance of their work. Persons working for the Producer who have access to the personal information of other Designated Persons must use appropriate control measures and mechanisms to protect this information. Persons working for the Producer may not share, copy or use the personal information of other Designated Persons for purposes other than the performance of their work.
6. Communicating personal information
The Producer may also disclose the Designated Persons’ personal information to third parties for purposes detailed in this Policy and in other policies and notices of the Producer, or as required or permitted by the Act respecting the protection of personal information in the private sector.
For example, the Producer may disclose the Designated Persons’ personal information to the following categories of third parties:
- Government agencies that need to access it (for example, to respond to employment insurance claims and queries, as part of a grant or program application, etc.).
- The Producer’s service providers, when necessary for the performance of a service contract entrusted by the Producer to said service providers. These services may include: audit services, information technology services, payroll administration services, human resources administration services, benefit provision and administration services, or professional services firms such as law firms or accounting firms that provide professional services to the Producer. The Producer may disclose the Designated Persons’ personal information to some of its service providers located outside of Quebec. The Producer will enter into a written contract with any supplier, providing the protections required to ensure the protection of the Designated Persons’ personal information, in accordance with the Act respecting the protection of personal information in the private sector.
- To third parties as part of reference or background checks or when contractually required by a client of the Producer.
- To third parties as part of an intended or completed business transaction (for example, the purchase/sale of a business or assets, a merger or a financing transaction) to which the Producer is a party, but only to the extent that the personal information is necessary for such transactions, in which case the Producer will comply with the applicable legal requirements when handling the personal information.
- To third parties, in order to allow the production of a work or its exploitation, and only to the extent deemed reasonable.
In addition, the Producer will cooperate with the organizations responsible for enforcing the Act respecting the protection of personal information in the private sector and will comply with any court order or law requiring the disclosure of personal information, without additional notice to or consent from the persons working for the Producer concerned.
7. Accuracy, access and rectification
Persons working for the Producer must provide the Producer with accurate and complete personal information and must update their personal information held by the Producer promptly after any changes are made to said information.
Designated Persons may request information about their personal information held by the Producer as well as access to this information. Designated Persons may also request that their personal information be modified if it is inaccurate or incomplete, subject to various exceptions under the Act respecting the protection of personal information in the private sector (including when access must be denied to protect other persons and to protect the Producer’s privileged or confidential information).
Designated Persons may also request more information about the Producer’s handling of their personal information, including information regarding the categories of individuals who have access to their personal information within the Producer and the retention period applicable to their information.
Designated Persons may request to access their personal information or have it modified by addressing such requests in writing to their manager or supervisor. Designated Persons who are not satisfied with the outcome of a request made to their manager or supervisor may submit a formal access request directly to the Privacy Officer.
8. Roles and responsibilities of staff members throughout the life cycle of personal information
All Designated Persons to whom personal information is disclosed in the course of their work are responsible for maintaining the confidentiality of such information to the extent provided in this Policy.
Specifically, Catherine Auclair, Senior Vice-President, Finance and Administration ([email protected]), serves as the Producer’s Privacy Officer and is responsible for ensuring compliance with the Act respecting the protection of personal information in the private sector.
9. Complaints and questions
Designated Persons who believe that their personal information has been handled in violation of this Policy may raise the matter with their manager or supervisor. Designated Persons who are not satisfied with the outcome of their complaint and of their question must contact the Privacy Officer, Catherine Auclair, at [email protected].
Any privacy incident involving personal information must be reported immediately to the Privacy Officer. A privacy incident includes the following situations:
- Access to personal information that is not permitted by law;
- Use of personal information that is not permitted by law;
- Disclosure of personal information that is not permitted by law;
- Loss of personal information or any other violation of the protection of such information.
10. Changes to this Policy
The Producer regularly reviews its policies and procedures and may review this Policy from time to time. This Policy, as reviewed from time to time, may be accessed from the following websites: kotv.ca, kodistribution.ca, koscene.ca, ko24.ca, groupeko.ca.
In addition, from time to time, the Producer will provide Designated Persons with training on information security and the protection of personal information.