Office of the Saskatchewan Information and Privacy Commissioner. Privacy Protective Survey Guidance. 14 March 2024. 11 Therefore, you should not use an online survey provider that allows third parties to track survey participants. Many online survey providers offer their services under non-negotiable terms of service and privacy policies. It is your responsibility to ensure that the provider’s terms of service agreement and privacy policy allow for the secure collection, retention, use, disclosure, security and disposal of personal information in accordance with FOIP and LA FOIP. For example, consider how the terms of service address the following: • Data ownership (possession or control) • Prohibitions against selling, sharing or disclosing the data • Controls on use of data by the provider’s staff • Measures to protect individuals right of access to their own personal information • Account and data deletion and destruction • Safeguards • Privacy breach response Online survey providers may update or change their terms of service and privacy policies. In some cases, the online survey provider may be entitled to change the terms of service without notice to you. Survey data may be stored outside Canada depending on the location of the online survey provider’s servers. Storing data outside Canada may make it subject to the laws of that jurisdiction. There is no prohibition against the storage of data outside Canada. However, you will need to ensure that storage of the data outside Canada is not contrary to your public body’s policies and does not put the data unnecessarily at risk. You should also ensure that individuals are notified that their data will be stored outside Canada and that reasonable measures are in place to protect privacy and security of the information. This will require you to assess the risk of storage outside Canada. Information Management Service Providers If you are using a third-party service to conduct the survey, consider if it qualifies as an information management service provider (IMSP) under FOIP or LA FOIP. Subsection 2(1)(e.1) of FOIP (subsection 2(1)(e.1) of LA FOIP) defines information management service providers as a person or body that processes or provides information management or information technology services to a government institution or local authority with respect to the record.
RkJQdWJsaXNoZXIy MTgwMjYzOA==