Privacy

The Region of Durham is committed to safeguarding personal and health information in accordance with the Municipal Freedom of Information and Protection of Privacy Act and the Personal Health Information Protection Act. Our Personal Information Privacy Policy outlines how we collect, use, and protect your information, ensuring transparency and access rights. It also specifies the roles and responsibilities of our employees, agents, and departments in securely managing personal and health information. 

Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)

• Who does it apply to?
  • The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) applies to all local government organizations in Ontario, including the Region of Durham and our eight local area municipalities.
    
    
• What are the privacy implications?
  • MFIPPA is meant to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information.

Personal Health Information Protection Act (PHIPA)

• Who does it apply to?
  • The Personal Health Information Protection Act (PHIPA) applies to individuals and organizations involved in the delivery of healthcare services. At the Region, this includes our:
    • Health Department
    • Long Term Care Division
      
      
• What are the privacy implications?
  • PHIPA governs the manner in which personal health information (PHI) may be collected, used and disclosed
  • PHIPA also provides a means for redress through the Office of the Information and Privacy Commissioner of Ontario (IPC) when privacy rights relating to personal health information have been violated.

Questions about the Region’s use and compliance with MFIPPA and PHIPA can be directed to privacy@durham.ca.

Collection of personal information

• We only collect your personal information through Regional websites or mobile applications when you voluntarily provide it to us. This includes when you:
  • Participate in an online forum, poll or survey
  • Fill in a feedback or contact form
  • Request further information about a specific topic
  • Send us an email
  • Create a user profile for online services
    
    
• The collection, use and disclosure of personal information is limited to information critical to providing Region services.
  
  
• You will be provided with a notice of collection before any personal information is collected through our websites or mobile applications. If you choose not to provide personal information online, you can contact the Region by telephone, fax, mail or in person. (Not all options may be available in every situation).

Use of personal information

• Whenever the Region collects your personal information, it will be used in accordance with the consent you have provided to deliver the services you have requested.

Sharing or disclosing your personal information

• Your personal information will not be disclosed except to authorized personnel (which may include elected officials, managers, employees, volunteers, contractors and vendors) for the purpose of addressing your feedback and/or to provide you with services you have registered for or otherwise requested.
  
  
• We do not trade, rent or sell your information to any outside company or organization. We will not reveal specific information about you to unaffiliated third parties for their independent use, except if required to do so by law.

Transactions where your personal information enters a system of record

• The Region has a number of applications and databases that are required to administer Regional services. Information that is provided to us online through our website(s) may be processed and stored in a separate, secured Regional database.

Questions about the collection, use, and disclosure of personal information can be directed to privacy@durham.ca.

Browsing

Cookies 

• A cookie is a small text file that a website creates and accesses through your browser when you visit the site. Cookies are used for many purposes, such as to track language preferences, provide customized web page content, and display website navigation history.
  
  
• Cookies used by the Region do not contain personally identifying information and do not give us access to anything on your device. We only use ‘session’ cookies that expire with each visit (unlike ‘permanent’ cookies that can track visitors across multiple visits, websites, and time). Our session cookie contains a randomized number intended to help your browser interact better with dynamic content on our site and is not for tracking purposes. Should you opt-out of our web analytics, a cookie will be set to recognize your preference. Data generated from the Region’s cookies are not used to identify visitors and are never shared with third parties.

Email newsletters 

• We comply with Canada's anti-spam law when you to subscribe to our email newsletters. When you subscribe, you authorize us to collect information about yourself to send you an email newsletter from time to time and for notification and/or account maintenance/recovery purposes. You can unsubscribe at any time by clicking the unsubscribe link at the bottom of the email newsletter.

Third party vendors and sites 

• The Region of Durham uses third party vendors to provide it with technology infrastructure, systems and software to operate its websites and to provide services to Regional residents. Where personal information is disclosed to vendors, the Region requires the vendors to use your personal information in accordance with Regional by-laws, policies and procedures.
  
  

• Links to external sites may exist on the Region’s webpages. We are not responsible for the content and the privacy practices of sites other than our own. We encourage you to examine each site’s privacy policy and disclaimers to make your own decisions regarding the accuracy, reliability and completeness of material and information found there.

Questions about the Region’s websites can be directed to privacy@durham.ca.

Payments

Online transactions

• You can pay for some Regional Services (e.g. garbage tags, water services, paytickets, etc.) on the Region’s websites. We do not process any payment transaction on the Region’s infrastructure; we redirect it to our transaction processor vendor who is compliant with the Payment Card Industry (PCI) Data Security Standard (DSS).
  
  
• These transactions are done through SSL-encrypted technology. This means that your payment information is transmitted to us securely. After your transaction is complete, we do not retain your credit card or payment information.

Questions about payments can be directed to privacy@durham.ca.​​​​​​

Portal Interactions

User profiles

• When you register for a web or mobile account, your personal information will be used to build your user profile. Your user profile helps the Region to understand your preferences and helps us to deliver services in a way that is relevant to you. Your user profile may grow as you consent to providing additional personal information to facilitate various online services and/or transactions.
  
  
• You can review and correct any information in your user profile online as well as close or terminate your account at your discretion.

Questions about your interactions with any Regional portals can be directed to privacy@durham.ca.​​​​​​

Video surveillance cameras are found in various Regional facilities and are used only for specific purposes related to the safety and security of people, facilities, and assets. Any personal information collected is pursuant to the Municipal Freedom of Information and Protection of Privacy Act and collected under the authority of the Municipal Act, the Occupier's Liability Act, and the Region's Corporate Policies and Records Retention Schedule Policy.

• If you have any questions related to video surveillance at Regional facilities, please contact the Region's Access and Privacy Office.

Disclosure to law enforcement

• The Region discloses video records to law enforcement agencies in Canada upon request, providing the records are used for the purposes of an active law enforcement investigation.

Questions about the video surveillance can be directed to privacy@durham.ca.​​​​​​

Social Media

Use of social media by the public

• Regional social media accounts are publicly accessible, meaning posts and comments are visible to the public. For your own protection, please do not post any personal information about you or anyone else (including email addresses, mailing addresses and telephone numbers). Personal information posted to social media accounts may be deleted without notice. If personal information is required, the Region will request it via direct message to maintain confidentiality. Information on community guidelines for use of Regional social media accounts is available here.

Use of social media by staff 

• With the exception of photographs/videos, Regional staff are prohibited from posting or sharing personal information on Regional social media accounts. Photographs and/or videos that feature a member of the public may be posted or shared if the person in the photograph/video has provided written consent or if the photograph/video was taken at a public event where no expectation of privacy existed.

Authenticating to the Region’s website using social media

• Social media accounts, such as Facebook and LinkedIn, are provided by third parties who have their own terms of use, policies, procedures and privacy policies. When you use your social media accounts to authenticate to the Regional website, you do so at your own risk.
  
  
• When you choose to authenticate to the Region’s websites using your social media, the Region will be able to see information contained within your public profile. The Region collects and uses the email address and name that are associated with your social media account. The Region will not otherwise use your personal information contained within your public profile (including your contact lists) without your knowledge and consent.​​​​​

Questions about social media may be directed to CCO@durham.ca.

Web Analytics 

Web analytics is the collection, analysis, measurement, and reporting of data about web traffic and visits. This data is used to improve our website and deliver on our public education mandate. It also helps us complete administrative tasks such as:

• Communications and information technology statistics, audit and evaluation, research, planning and reporting.

Tracking your website visit

• When you visit Durham.ca, the Region’s web server automatically collects a limited amount of information related to your visit such as your Internet Protocol (IP) address, the type of browser used, the date and time of your visit, and the IP address locations to which you linked during your visit to our site. This information is used for statistical analysis, evaluation of the effectiveness our website, and to plan for future services.

Questions about web analytics can be directed to privacy@durham.ca.