Last updated: 2025-01-14
1. As a business registered in the Province of British Columbia, Yellowhead Road & Bridge (Company) (“YRB”) is subject to compliance with the British Columbia Personal Information Protection Act (“PIPA”). PIPA sets out rules for how organizations collect, use, and disclose personal information. This could include personal information of our employees, such as full name, birthday, and spouse; for the general public who contact us, this would generally include their full name, personal phone number, and email address that they provide via telephone or internet submission. YRB is committed to being accountable for how we handle personal information, and is committed to being accountable for following this Privacy Policy (the “Policy”).
2. YRB will only collect, use, or disclose personal information that is necessary to achieve the purpose of its collection. YRB will only collect the minimum amount of personal information necessary to achieve the purpose of its collection. The purpose of collecting our employee’s personal information would include but not be limited to verification of identity, verification of legal status to work in British Columbia, verification that employees meet our standards for training and certification, and for the purposes of providing compensation to employees; The purpose of collecting personal information from the general public would include but not be limited to communicating with representatives of other businesses, entities or governmental organizations, or communicating with members of the public who have provided feedback or inquiries.
3. When individuals are providing personal information to YRB in the scope of this Policy, it is generally under the principle of implied consent; that is, that by recording your personal information on a form submitted to YRB, whether as a member of the general public or an employee, you are giving consent to that information being stored for our business’ purposes. YRB commits to notifying individuals that this Policy exists, and providing access to view this Policy, on all company websites collecting personal information. Individuals can withdraw their consent regarding their personal information at any time by providing YRB with reasonable notice, unless withdrawing consent would frustrate YRB’s performance of a legal obligation. In the case that an individual withdraws their consent, YRB will stop collecting, using or disclosing the personal information, unless the collection, use or disclosure of the personal information is otherwise permitted without consent by PIPA. YRB will inform the individual what consequences will result from withdrawing their personal information, such as their personal information found within their correspondence with YRB being withdrawn, or their employment with YRB being terminated as a result of YRB no longer having the individual’s consent to store personal information.
4. YRB commits to obtaining individuals’ express or implied consent to collect, use, or disclose personal information, unless authorized or required by law to do so without consent. YRB retains the right to disclose personal information where authorized by PIPA or required by law, such as in the event of a court order, subpoena, or search warrant. YRB retains the right to collect, use, or disclose personal information without consent if it is reasonable for the purposes of maintaining our reporting relationship to the British Columbia Ministry of Transportation & Infrastructure (the “Ministry”), or reasonable for the purposes of establishing, maintaining, or terminating an employer-employee relationship. YRB retains the right to collect, use and disclose personal information without consent where required or authorized by law, such as for the purpose ensuring YRB’s compliance with statutory and regulatory requirements.
5. YRB retains all collected personal information of current employees for the duration of their employment. Once an employee is no longer with the company, their personal contact information will be kept for as long as it is necessary to retain for business purposes. Personal banking information not necessary for business purposes will be removed from a past employee’s personnel file one the year following their last day of work.
6. Personal information collected from members of the public will be retained for the purposes of reporting communications to the Ministry until two years after the conclusion of the Highway Maintenance Agreement during which the information was collected.
7. YRB will make reasonable efforts to ensure that all personal information collected and retained is accurate and complete. Individuals may request that YRB correct any errors or omissions in their personal information that is under YRB’s control. If YRB is satisfied on reasonable grounds that a request should be implemented, YRB will correct the personal information and send the corrected information to any organization the prior version of the information was sent to within the calendar year before the date on which the correction was made. However, if YRB is not reasonably satisfied that a correction should be implemented, YRB will simply annotate the personal information, indicating the details of the request for the correction to be made.
8. YRB may collect personal information from or on behalf of a third party organization and may use this personal without the consent of the individual to whom the information relates, provided that the individual previously consented to the collection of their personal information by the third party organization or the personal information is disclosed to, used, or collected by YRB solely for the purposes for which the information was previously collected by the third party organization and assists YRB in carrying out work on behalf of a third party organization. YRB may disclose personal information to a third party organization or a public body without the consent of the individual to whom the information relates where YRB is authorized to collect personal information on behalf of another organization or where the individual consented to the collection of personal information by YRB and the personal information is disclosed to a third party organization solely for the purposes for which YRB previously collected the information and to assist the third party organization to carry out work on behalf of YRB.
9. PIPA requires YRB to protect all personal information under YRB’s control from unauthorized access, collection, use, disclosure, copying, modification, disposal, or other similar risks. YRB is also responsible to protect retained personal information via security controls against snooping, hacking, theft, loss, tampering, and unauthorized duplication. YRB utilizes access controls such as folder permissions, user accounts, and secure passwords to prevent unauthorized internal users from accessing personal information. YRB utilizes access controls such as user accounts, secure passwords, and firewalls to prevent unauthorized access from outside the company. In the event of a suspected or confirmed privacy breach, YRB will contact affected individuals with any confirmed information regarding the unauthorized release of personal information.
10. PIPA provides for any individual to request access to their own personal information under YRB’s control. Individuals have the right to access their personal information, information about the ways their personal information is or has been used, and the names of the individuals and organizations to which their personal information has been disclosed. Any such requests must be made in writing and must provide sufficient details to enable YRB to identify the individual and the personal information being sought. Individuals will be required to prove their identity before any such request is fulfilled. YRB retains the right to charge a fee for fulfilling a request, provided the information requested is personal information and not employee personal information that is collected, used or disclosed solely for the purposes reasonably required to establish, manage, or terminate an employment relationship between YRB and the individual requesting the personal information. A written fee estimate will be provided in advance. A deposit may be required in advance of fulfilling any request, depending on the size of the fee calculated. Requested personal information will be provided within 30 days, as per PIPA, unless YRB is authorized or required by PIPA to refuse access, in which case the applicant will be informed in writing about the reason for the refusal and any available further steps, including contact information for a YRB employee who can answer the applicant’s questions about the refusal. YRB reserves the right to withhold disclosure of personal information in limited circumstances, including where doing so would reveal personal information about another individual or could reasonably be expected to threaten the safety or physical or mental health of another individual.
11. In the event any employee or member of the public has a question about the collection of personal information or holds a complaint against YRB in relation to the handling of personal information, YRB’s Chief Information Officer, Geoff Sargent, reachable via email: geoff[at]yrb.ca is the company contact responsible with YRB’s PIPA compliance. Complaints should be made and provided by email. If the complaint is not resolved to the satisfaction of the complainant within a reasonable time frame, the Office of the Information and Privacy Commissioner should be the next step. They are reachable via telephone at (250) 387-5629.