At the time of the drafting of this policy, neither Randy Hillier, nor his staff, agents, or volunteers are in possession of any list products from Elections Ontario.
Scope of Policy
This policy applies to Randy Hillier, MPP, his office, staff, agents, and volunteers; and during the writ period, his campaign and campaign team, including volunteers. This policy applies to any and all list products received from Elections Ontario.
Restrictions on Use
List products received from Elections Ontario shall only be used in compliance with Section 17.4 of the Election Act. Information is not used for commercial purposes, and solely for electoral purposes during the writ period, such as communicating with voters, soliciting campaign support, soliciting campaign volunteers and donors, and administering the distribution of literature, advertising and election campaign signs.
IMPLEMENTATION AND ENFORCEMENT OF THIS POLICY
Removing records from the office
List products shall only be removed from the office when it is absolutely necessary to do so.
Employees, volunteers or agents of Randy Hillier must obtain approval from the CPO, and original documents shall remain in the office with only copies to be removed.
A record of the information being removed shall be tracked using a tracking compliance form which shall be stored in a secured filing cabinet in the possession of the CPO.
While in transit, paper records shall be securely packaged and shall remain in the possession of the employees, volunteers or agents of Randy Hillier.
If being used at home, records shall be accessible only to the employees, volunteers or agents of Randy Hillier and must be kept locked away when not in use.
Electors' personal information, whether in printed or electronic format, shall never be accessed by employees, volunteers or agents of the Political Entity while travelling on public transportation.
Electronic records containing electors' personal information shall be stored on password-protected data storage devices and applications, or removable drives rather than on the hard drive of a laptop or home computer.
Removable drives shall always remain within the possession of the employees, volunteers or agents of Randy Hillier or be kept in a secure location that is not accessible to others.
Laptops and home computers
Access to laptops and home computers shall be password-controlled, and any data on the hard drive shall be encrypted. Other reasonable safeguards, such as anti-virus software and personal firewalls, shall also be installed.
List products containing electors' personal information shall not be stored on shared computers and laptops.
Laptops shall be stored in a secure location.
Randy Hillier, the CPO, and assigned agents, volunteers and employees shall protect the privacy and confidentiality of personal information stored on wireless devices such as cell phones. Access to such devices must be password-controlled, and any stored data should be encrypted. When working at locations outside the office, employees, volunteers or agents of Randy Hillier shall maintain constant control of wireless devices and care shall be taken to prevent loss or theft.
Email, fax and photocopy
When working at home or at other locations outside the office, employees shall not send electors' personal information by e-mail or fax.
If photocopies of list products are required, employees of Randy Hillier shall conduct the task and photocopy machines shall not be left unattended.
DISPOSITION PROTOCOL FOR LIST PRODUCTS
Return or Secure Destruction of list products received by Randy Hillier shall be done in compliance with Section 6 of Elections Ontario's Guidelines for the use of Electoral Products, and it shall be the responsibility of the CPO to ensure that such compliance is strictly adhered to.
TRAINING ON PRIVACY CONTROLS
Electoral products shall only be made available to those who need access under the permitted uses of these list products through the CPO.
If a suspected unauthorized access should occur, or should there be a loss or theft of the electoral products, this shall constitute a privacy breach and the CPO shall:
- immediately notify Elections Ontario of the breach, and the steps being taken to mitigate damages;
- contain the breach and identify the source and/or cause of the breach;
- mitigate any harm resulting from the breach
- make every reasonable effort within the law to retrieve electoral products that were lost or stolen;
- document the circumstances that led to the incident and where necessary contact law enforcement; and
- review and update internal policies, processes and procedures to prevent future incident
Roles and Responsibilities
The CPO shall be responsible for ensuring compliance with all filing requirements provided by Elections Ontario under the Guidelines for the Use of Electoral Products.
The CPO shall notify Elections Ontario of their removal or resignation as CPO, and Randy Hillier shall be responsible for the appointment of a new CPO.