Privacy policy

Objective
The purpose of this policy is to establish the general principles that govern CGI members’ management and protection of personal information, which may be collected, used, and disclosed during the normal course of their professional duties at CGI. 

Scope
While exercising its right to collect, use and disclose personal information for legitimate business purposes, CGI’s protection of personal information extends to all personal information under its custody or control.

Definition of Personal Information
For the purpose of the present Privacy Policy, “personal information” refers to any information, factual or subjective, recorded under any form, about an individual, and which allows this individual to be identified. Personal information includes, the name, birth date, gender, religion, income, home telephone number, personal mobile telephone number, home address, personal e-mail address, personal fax number, social insurance number/social security number, financial or health information and opinions about an individual.

However, personal information does not include an individual’s “business contact information”, which comprises an individual’s name, position name or title, business telephone number, business address, business e-mail, business fax number and other similar business information.

Governing Principles of Personal Information Protection

• Accountability
  CGI is responsible for the personal information under its custody or control. Where CGI transfers personal information to a third party, CGI shall contractually require that a comparable level of protection is provided to the personal information transferred.
  
  CGI has designated a Privacy Officer to oversee all ongoing activities related to the development, implementation, maintenance and adherence to CGI’s policies and procedures covering privacy as well as to ensure compliance with applicable laws, and regulations.

• Identifying Purposes
  Where CGI proceeds with the collection of personal information, CGI shall inform the individual of the identified purpose for which the personal information is being collected at, or before the time of collection.

• Consent
  Except where permitted or required by law, CGI will only collect, use and disclose personal information with the knowledge and consent of the individual. CGI will use the form of consent, either express or implied, that reflects the nature of the information being collected, taking into account its sensitivity and reasonable expectations of the individual. All personal information will be collected by fair and lawful means.
  
  Consent will also be obtained by CGI when a new use for the personal information is identified.
  
  An individual may withdraw his/her consent at any time with respect to the continuing use or disclosure of his/her personal information, subject to legal or contractual restrictions and reasonable notice. CGI will inform the individual of the implications of such a withdrawal.

• Limit to Collection, Use, Disclosure, and Retention
  CGI will only collect personal information that is necessary to fulfill the purposes identified to the individual.
  
  CGI will only use and disclose personal information for the purpose for which it was collected and, where applicable, with CGI accepted client policies and procedures, all in accordance with the applicable laws and regulations.
  
  CGI will only retain personal information as long as is necessary for the fulfillment of the purpose identified, as well as for legal purposes. Furthermore, personal information retained by CGI shall be disposed of/destroyed in accordance with CGI’s Records Management and Retention Policy and Records Management and Retention Policy Manual guidelines and/or client’s specifications agreed to by CGI as part of its contract with the client, all in accordance with the applicable laws and regulations.

• Accuracy
  Where CGI collects personal information, CGI shall take appropriate measures to ensure that the personal information is accurate, complete, and up to date as is necessary to fulfill the purpose for which the information is to be used.

• Individual Access
  Subject to the limitation below, and upon written request, an individual will be informed of the existence, use or disclosure of his/her personal information, and of his/her right to access his/her personal information, subject to certain legal restrictions. Any refusal or restriction to an individual’s request of access to his/her personal information will be made in writing, and will provide the reasons for such refusal or restriction within a reasonable time.
  
  Subject to the limitation below, an individual upon written request may also request that a correction be made with respect to his/her personal information in CGI custody or under CGI control. All requests to correct personal information must be accompanied by the appropriate supporting documentation. Where the request for correction is not resolved to the satisfaction of the individual, the substance of the unresolved matter will be recorded by CGI.
  
  Notwithstanding the foregoing, where CGI collects personal information for a third party or when CGI is entrusted with personal information by a third party, CGI’s obligation to maintain the accuracy of the personal information, as well as the obligation to provide access and correction to an individual of his/her personal information will be determined and governed by a formal agreement between CGI and the third party concerned.

• Safeguards
  Personal information shall be protected in accordance with CGI’s Information Security Policy and, where applicable, with CGI accepted client policies and procedures, all in accordance with the applicable laws and regulations.
  
  Personal information is to be protected from unauthorized use, disclosure, access, copying and modification. These safeguards apply to personal information irrespective of the storage medium. Such safeguards may take the form of locked filing cabinets, restricted access to information (physical and on a need-to-know basis, alarm systems or other electronic control devices, technological tools such as passwords, encryption, firewalls, anonymizing software, etc.).
  
  The selection of safeguards will be determined according to the nature of the personal information to be protected and, where applicable, in accordance with CGI accepted client policies and procedures.

Sanctions
Violations of this policy may result in disciplinary action commensurate with the seriousness of the infringer’s behaviour.

Compliance
CGI members are expected to comply with all aspects of the present Privacy Policy and to support others in doing so.

 All requests, questions, complaints, or violations pertaining to this policy should be directed in writing to:

The Privacy Officer
CGI Group Inc.
1130 Sherbrooke Street West, 7th floor
Montreal, Quebec
Canada H3A 2M8