OCAP Principles and Your Privacy Rights

Veness Consulting recognizes and respects the OCAP® principles (Ownership, Control, Access, and Possession), which were developed by the First Nations Information Governance Centre as a framework for how First Nations data and information should be collected, protected, used, and shared. While OCAP® specifically applies to First Nations communities, we believe these principles represent best practices in data governance that should guide all our interactions with personal information, particularly when working with Indigenous clients, partners, and communities in Canada.

Ownership

We recognize that communities and individuals own their information. When working with First Nations communities, we acknowledge that the community collectively owns information in the same way that an individual owns their personal information. We will not claim ownership over information that rightfully belongs to the communities or individuals we serve.

Control

You have the right to control how your information is collected, used, and disclosed. For First Nations communities, this means having control over all aspects of research and information management processes that impact them. We commit to seeking appropriate authorization and involving you in decisions about your data throughout our engagement.

Access

You have the right to access your information and data collected about you. First Nations communities must have access to information and data about their communities and members, regardless of where it is held. We will provide you with access to your information upon request and ensure transparency in how your data is being used.

Possession

While ownership and possession are distinct concepts, we recognize your right to possess and safeguard your information. For First Nations, this means asserting and protecting their information against misuse. We implement appropriate security measures and, where applicable, support the physical control of data by the communities who own it.

Your Privacy Rights Under Alberta Law

Under Alberta's Personal Information Protection Act (PIPA) and federal privacy legislation, you have several important rights regarding your personal information. You have the right to know what personal information we hold about you and how it is being used. You can request access to your personal information at any time by contacting us using the information provided below. You have the right to request corrections to any inaccurate or incomplete information. You may withdraw your consent for us to use your personal information for certain purposes, though this may affect our ability to provide services to you. You have the right to file a complaint with the Office of the Information and Privacy Commissioner of Alberta if you believe your privacy rights have been violated. We are committed to responding to all access requests and privacy concerns within the timeframes required by law, typically within 30 days.

Canadian Federal Privacy Laws

In addition to provincial privacy legislation, Veness Consulting adheres to federal privacy laws, most notably the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA applies to federally regulated organizations, such as banks and telecommunications companies, and to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities in provinces that do not have their own substantially similar privacy legislation.

Key principles under PIPEDA include:

Accountability: Organizations are responsible for personal information under their control.
Identifying Purposes: The purposes for collecting personal information must be identified before or at the time of collection.
Consent: Knowledge and consent are required for the collection, use, or disclosure of personal information.
Limiting Collection: Collection of personal information must be limited to what is necessary for the purposes identified.
Limiting Use, Disclosure, and Retention: Personal information should only be used or disclosed for the purposes for which it was collected, and retained only as long as necessary.
Accuracy: Personal information must be accurate, complete, and up-to-date.
Safeguards: Security safeguards appropriate to the sensitivity of the information must be in place.
Openness: Organizations must make information about their privacy policies and practices readily available.
Individual Access: Individuals have a right to access their own personal information and challenge its accuracy.
Challenging Compliance: Individuals should be able to address a challenge concerning compliance with the above principles.

Looking ahead, Canada is undergoing federal privacy law reform, with proposed legislation like Bill C-27 (the Consumer Privacy Protection Act) aiming to modernize and strengthen privacy protections in the digital age. We continuously monitor these developments to ensure our practices remain compliant with the latest legal requirements.