Legal notices

The Association Québécoise de la Production Médiatique’s Policy Framework

Privacy and Data Protection Policy for Individuals Working for the Producer

Effective date: September 22, 2023

1. Purpose and Scope

PVP MEDIA Inc. and its subsidiaries (hereinafter, the “Producer”) undertake to handling the personal information of individuals in its employ in accordance with the Quebec Act Respecting the Protection of Personal Information in the Private Sector. The Privacy and Data Protection Policy for Individuals Working for the Producer (hereinafter, the “Policy”) informs individuals working for the producer of its practices for collecting, using and sharing personal information, and their rights regarding their personal information.

This Policy applies to all individuals working for the Producer (hereinafter, the “Designated Individuals”).

2. What is Personal Information?

In this Policy, the term “personal information” refers to any information regarding a natural personal that, directly or indirectly, identifies them.

3. How does the Producer Collect Personal Information?

The Producer collects personal information on Designated Individuals in order to manage its working relationship with them. The Producer may collect the following personal information on Designated Individuals:

• Identifiers and contact information, such as their name, email address, telephone number, government-issued identification (such as their social insurance number, visa or passport information), work or visitor’s permit.
• Demographic information, such as their date of birth, gender, citizenship, and medical information. In some cases, the Producer may collect, on a voluntary basis, demographic information in relation to an employment equity, diversity and inclusion program (such as ethnicity, sexual orientation, etc.).
• Professional information or information related to their position, such as their job title and salary history, professional experience, education, certifications and other qualifications, information about benefits and leave, information regarding issues and disputes that may arise, reports and performance appraisals, results of psychometric tests, disciplinary records, date of termination of employment and reason for termination (voluntary or involuntary and details).
• Financial information, such as the information provided by individuals working for the Producer for payroll management (financial institution and bank account number) and the information required for issuing tax forms.
• Emergency contact information, such as their name, contact information and their relationship to the Designated Individual.
• Information that the Producer collects on their use of the internet, its networks, devices and premises, such as their IP address (if it identifies the employee), and their device ID (e.g., if the Designated Individual connects to the Producer’s Wi-Fi). The Producer may collect information on the Designated Individuals’ use of their work email account, the internet, computers, telephones and other devices belonging to the Producer to which they have access through their work, and their personal device used for their work. The Producer may also collect video and still images through closed-circuit video cameras.
• Other information, such as information provided by the Designated Individual through the payroll management system.

4. How is Personal Information Stored and Destroyed?

The Producer takes the appropriate control measures and mechanisms to protect the personal information of Designated Individuals. These measures include restricting physical access to the Producer’s offices and files, restricting the unauthorized access, sharing, use and wrongful handling of the personal information which the Producer holds and controls, storing archive documents with trusted third parties, in secure premises, using firewalls, passwords and file encryption for online activities.

The Producer’s aim is to prevent the unauthorized access, loss, abuse, sharing and modification of the personal information in its possession. The Producer uses these same protection measures when deleting and destroying the personal information of Designated Individuals.

The Producer is responsible for ensuring personal information in its possession is stored in Quebec, or whenever this is not possible, in Canada. However, information stored on the servers of the Producer’s service providers may be located outside of Canada and may therefore be subject to the laws of the country in which it is stored, including any legislation providing governmental authorities access to the information. Subject to such foreign legislation, the Producer will use, to the best of its abilities, contractual measures to maintain a level of protection of personal information that is at least equivalent to the protection applicable in Quebec.

The Producer retains the personal information of Designated Individuals only for as long as is deemed reasonably necessary to fulfil the purposes for which it was collected, or as permitted or required by the Quebec Act Respecting the Protection of Personal Information in the Private Sector. Once the personal information is no longer required, it is safely destroyed or de-identified, in accordance with the Quebec Act Respecting the Protection of Personal Information in the Private Sector.

The following retention periods for the personal information of Designated Individuals are deemed reasonably necessary:

• In perpetuity for documents containing usage rights, copyrights, neighbouring rights or any other rights needed to use any particular material (e.g. authors’ contracts, directors’ contracts, actors’ contracts, etc.).
• Seven (7) years following the end of the project on which the individual was employed by the Producer, for tax documents.
• Three (3) years following the end of the project on which the individual was employed by the Producer, for all other personal information.

5. How does the Producer Use Personal Information?

The Producer uses the personal information of Designated Individuals to manage their working relationship, for other legitimate purposes as detailed in this Policy, and for other purposes permitted by the Quebec Act Respecting the Protection of Personal Information in the Private Sector.

For example, the Producer may use the personal information of Designated Individuals for the following purposes:

• To manage staff, including verifying the identity of individuals working for the Producer, managing taxes and social security, planning schedules and monitoring presences and hours worked, setting up emergency contact information, and handling the work-related requests of Designated Individuals.
• To process social benefits, including determining the eligibility of individuals working for the Producer, their dependants and beneficiaries.
• To administer payroll, sick pay and leave.
• To evaluate performance, including making decisions related to assignments, training, salaries and promotions.
• To take the required measures to protect the health, safety and physical and psychological integrity of the Designated Individuals.
• To administer internal business activities, such as implementing disaster recovery and business continuity plans and procedures, or other similar emergency plans and procedures; conducting internal reviews, audits and investigations; creating statistics and analytical tools for legitimate business purposes (such as improving business processes or managing staff).
• To prepare and manage work permit applications.
• To comply with legal and regulatory obligations, meet safety requirements, and for fraud management purposes, including internal inquiries, failure to perform duties and breach of employment contract, including monitoring the use of the Producer’s information technology systems.

In addition to the above, the Producer may also, with their consent, collect the personal information of Designated Individuals for any other purposes when required to by the Quebec Act Respecting the Protection of Personal Information in the Private Sector.

The Producer may only make available to individuals in its employ, the personal information of other Designated Individuals to the extent necessary for the performance of their duties. Individuals working for the Producer who have access to the personal information of other Designated Individuals must ensure they take the appropriate control measures and mechanisms to protect the personal information. Individuals working for the Producer must not share, copy or use the personal information of other Designated Individuals for any purposes other than the performance of their duties.

6. How does the Producer Share Personal Information?

The Producer may share the personal information of Designated Individuals with third parties for the purposes detailed in this Policy and in the Producer’s other policies and notices, or as required or permitted by the Quebec Act Respecting the Protection of Personal Information in the Private Sector.

For example, the Producer may share the personal information of Designated Individuals with the following categories of third parties:

• Governmental organizations who require access (e.g. to respond to employment insurance claims, for grant or program applications, etc.).
• Service providers when required for the performance of a service contract entrusted to them by the Producer. These services may include audit services, information technology services, payroll administration services, human resource administration services, and the supply and administration of services or professional service firms such as law or accounting firms that provide professional services to the Producer. The Producer may share the personal information of Designated Individuals with service providers located outside the Province of Quebec. The Producer will enter into a written contract with all suppliers, stipulating the protective measures required to protect the personal information of Designated Individuals, in compliance with the Quebec Act Respecting the Protection of Personal Information in the Private Sector.
• To third parties in order to check references or run a background check, or where contractually required by a client of the Producer.
• To third parties for a planned or completed business transaction (e.g. the purchase/sale of a company or assets, a merger or a financial operation) to which the Producer is a party, but only as far as the personal information is required for such a transaction, in which case the Producer will comply with applicable legal requirements when processing personal information.
• To third parties in order to produce or use a project, and only to the extent deemed reasonable.

Furthermore, the Producer will cooperate with organizations mandated with applying the Quebec Act Respecting the Protection of Personal Information in the Private Sector and will comply with any court orders or laws requiring the sharing of personal information, without further notice or consent of the Designated Individuals concerned.

7. Accuracy, Access and Correction of Personal Information

Individuals in the Producer’s employ must provide the Producer with accurate and complete personal information and must update the personal information held by the Producer as soon as possible if said information changes.

Designated Individuals may request information about the personal information held by the Producer, ask to access said information, and ask to amend said information if it is inaccurate or incomplete, subject to a number of exceptions prescribed in the Quebec Act Respecting the Protection of Personal Information in the Private Sector (in particular when access must be refused in order to protect other individuals or to protect privileged or confidential information about the Producer).

Designated Individuals may also request further information about how their personal information is handled by the Producer, in particular regarding the categories of individuals who can access their personal information in the Producer’s employ, and the applicable retention period for their information.

Designated Individuals can address their requests to access or correct their personal information in writing to their manager or supervisor. Designated Individuals who are not satisfied with the outcome of their request addressed to their manager or supervisor may submit a formal access request directly to the Personal Information Protection Officer.

8. Roles and Responsibilities of Staff Members Throughout the Life Cycle of Personal Information

All Designated Individuals who receive personal information in the performance of their duties are responsible for maintaining the confidentiality of said personal information to the extent provided for by this Policy.

In particular, the individual occupying the role of production accountant performs the duties of Personal Information Protection Officer and is responsible for ensuring compliance with the Quebec Act Respecting the Protection of Personal Information in the Private Sector.

9. Complaints and Questions

Designated Individuals who believe their personal information has been processed in breach of this Policy may raise the issue with their manager or supervisor. Designated Individuals who are not satisfied with the outcome of their complaint or question may address the Personal Information Protection Officer.

Any privacy incident involving personal information must be immediately reported to the Personal Information Protection Officer. A privacy incident includes the following situations:

• Unlawful access to personal information.
• Unlawful use of personal information.
• Unlawful sharing of personal information.
• Loss of personal information or any other privacy breach.

10. Amendments Made to this Policy

The Producer reserves the right to regularly amend its policies and procedures, and may revise this Policy at any time. This Policy, as amended from time to time, may be consulted on the Producer’s website: https://www.pvp.ca/en.

Furthermore, the Producer may offer personal information protection and information security training to Designated Individuals from time to time.