Retention of personal information

Policy

• You can only retain personal information that is required for the purpose for which it was collected, and for as long as it required to fulfill the purpose of the collection or as permitted or required by law.
• You should not retain medical or other sensitive information in client file.
  • It is acceptable to copy an application to insure against loss during the underwriting process as long as you disclose the practice to the client.
  • The copy should be destroyed after it has been vetted against the copy that accompanies the client policy entrusted to you for delivery.
  • You must not destroy information that is the subject of a client request. The information must be retained for as long as necessary for the client to exhaust any recourse they may have.
• If you retain sensitive information other than as outlined above you must:
  • Ensure that you have security commensurate with the sensitivity of the information. For example, staff should
    • Obtain explicit written consent from the client.
    • A copy of the consent must be stored in the client file.

Consequences

Knowingly destroying information that is the subject of a client request is punishable by a fine of up to $10,000 on summary conviction or $100,000 for an indictable offense.

Privacy home
Helpful definitions