ÌÇÐÄvlog¾«Æ·

This procedure sets out the process for handling a privacy breach at the Conestoga College Institute of Technology and Advanced Learning (Conestoga) in accordance with Conestoga’s Protection of Privacy Policy.

ÌÇÐÄvlog¾«Æ· maintains a glossary of terms specific to the institution. The ones in use for this document are defined below.

1. Reporting - any Conestoga user that suspects a privacy breach must immediately notify their functional leader and email: privacy@conestogac.on.ca. Managers must notify this email address of any privacy breach for reporting purposes. 
2. Containment – the manager must take immediate steps to contain the breach and prevent any further unauthorized access to the personal information. The following steps - steps 3, 4 & 5 - can happen both in conjunction with containment and after containment.
3. Preliminary Assessment – Once a potential breach has been identified, the Vice President, Finance and Corporate Services or designate determines if further investigation is warranted, preserves evidence, and determines if law enforcement need to be involved. 
1. The Vice President, Finance and Corporate Services leads the assessment if needed. 
4. Notification 
   
1. Impacted individuals are notified by the manager or director of the unit / office where the breach occurred as soon as is reasonably possible. If the manager or director of the unit requires support and/or the notification is particularly complicated, they must reach out to the Vice President, Finance and Corporate Services. 
2. The Information and Privacy Commissioner of Ontario must be notified by the Vice President, Finance and Corporate Services when there is particularly sensitive information involved in the privacy breach and/or when there is a large number of individuals impacted. 
5. Risk Mitigation 
1. Based on the severity and scope of the breach, the Vice President, Finance and Corporate Services will decide whether further investigation is required. If it is, the VP will: 
1. Lead further investigation of the privacy breach if warranted. 
2. Identify prevention strategies to ensure a similar privacy breach does not reoccur. 
3. Monitor outcome of prevention strategies.