Privacy Notice – Business Resilience Service
The Business Resilience Service (“Service”) is a dedicated line to assist small businesses, not-for-profits, and charities (“Callers”) by providing information, answering questions and discussing options associated with the various economic stimulus programs associated with the Covid-19 pandemic.
We are very interested in protecting any personal information collected through the interactions supported by the Service. This means that you will be informed of the purpose for which your personal information is being collected and how to exercise your right of access to that information.
2. Who manages the Service?
The Service is an initiative managed by the Canadian Chamber of Commerce, funded by the Government of Canada and operated by Ernst & Young LLP, an Ontario Limited Liability Partnership (“EY”) and other Canadian CPA firms. Agents from EY, and other Canadian CPA firms (collectively, “Agents”) will be responding to Callers who contact the Service. Appropriate agreements have been put in place with the Agents, requiring that they maintain confidentiality and respect privacy in accordance with this Privacy Notice.
To support the Service operations, EY is licensing technology from Genesys Laboratories Canada, Inc. (“Genesys”), and ServiceNow, Inc. (“ServiceNow”). The personal data provided through the Service may be shared with one or more member firms of Ernst & Young Global Limited, each of which is a separate legal entity, and with the persons and entities mentioned below in the section “Who can access the information?”.
The specific tools to be used to support the Service operations are Genesys PureCloud and ServiceNow Customer Service Management. Genesys PureCloud is a telephony system used to provide call answering capabilities to Agents responding to calls from Callers inquiring about different funding and financial programs being offered by the Government of Canada during the Covid-19 pandemic. Genesys PureCloud is hosted on Amazon Web Services, Inc. (“AWS”) servers located in Canada.
ServiceNow Customer Service Management is used to manage assignment of calls to Agents and to record case notes taken during each call. The servers supporting this platform are also located in Canada.
3. Why is personal information needed?
The Service allows Agents to respond to Callers about different funding and financial programs being offered by the Government of Canada to support businesses during the Covid-19 pandemic. Information will be gathered from Callers to discuss options and approaches with respect to various funding and financial programs offered by government. The calls will be recorded in Genesys PureCloud and the case notes recorded by the Agents during each call will be stored in ServiceNow Customer Service Management.
When calling to the Service the Callers will be required to consent to, and acknowledge, the processing of their personal data in accordance with this Privacy Notice. They will be informed that their call will be recorded for quality and training purposes and to enhance our services.
Personal data may be processed the following purposes:
- Assessing the callers’ eligibility for various funding and financial programs offered by government associated with the Covid-19 pandemic;
- Use anonymized data to prepare statistical reports on how information is being requested based on diverse criteria such as the following: Organization’s postal code, call intent, related program, type of organization, sector, number of employees, province, impact or resolution;
- Using anonymized data to improve government support programs, improve government communication programs and improve government services;
- Quality and training purposes and to enhance the services provided through the Service.
The provision of personal data to the Agents is optional. However, if all or part of the personal data is not provided by the Callers, the Agents may be unable to carry out the purposes for processing.
4. What type of personal data will be processed?
By calling the Service, the Callers will be requested to provide the following:
- Caller’s first, middle and last name*.
- Business telephone number*.
- Name of organization*.
- Organization Postal code.
- Call intent. One or more options will be selected from these choices: General questions; related to specific program; related to status of completed application; related to understanding questions on application form; other.
- Related program. One or more options will be selected from these choices: Tax filing deadlines / extensions; deferral of tax payments and remittances; financing programs (CEBA, BDC, EDC); Rent relief (CECRA); Workforce (Wage Subsidies, Work sharing); Support for Employees (CERB, EI); Other program; N/A.
- Type of organization. One option will be selected from these choices: Business; not for profit; charity; other; N/A.
- Organization ownership characteristics. One or more options will be selected from these choices: Female-owned; Indigenous owned; LGBTQ owned; Start-up; None of the above; Prefer not to say; N/A*
- Organization Sector. One option will be selected from these choices: Hospitality; Real estate & Construction; Retail; Health Care; Technology; Industrial goods / Manufacturing; Oil & Gas; Financial Services; Agriculture; Fisheries; Other sector (specification will be required); N/A.
- Number of employees at organization. One option will be selected from these choices: No employees; Between 1 and 9; Between 10 and 24; Between 25 and 99; Over 100; N/A.
- Province of organization operations. One or more options will be selected from these choices: ON; QC; BC; AB; MB; SK; NL; PE; YT; NT; NU.
- % of drop in annual revenue. One option will be selected from these choices: No; Yes, 10% or less; Yes, between 10 – 19%; Yes, between 20 – 29%; Yes, between 30 – 39%; Yes, between 40 – 49%; Yes, between 50 – 59%; Yes, between 60 – 69%; Yes, between 70 – 79%; Yes, between 80 – 89%; Yes, 90% or more; N/A.
- Layoffs. One option will be selected from these choices: yes; no; other (specification will be required); N/A.
- Call resolution. One choice will be selected from: Resolved; Unresolved.
- Resolution details. If Resolved, one of these choices will be selected: Provided information (overview, criteria, how to apply) on a single program; provided information (overview, criteria, how to apply) on multiple programs; provided information on applications; provided general information. If Unresolved, one of these choices will be selected: Transferred to supervisor or Tier 2; directed call to CRA; directed call to Service Canada; directed call to other Government organization; out-of-scope (e.g. question irrelevant to what Agents can help with); Other (e.g. unable to help Caller at this moment)
- Resolution notes*. Free text boxes used by the Agents to capture notes on the conversation held with the Caller.
The data categories marked with an asterisk could constitute personal information so such data will be encrypted in the ServiceNow Customer Service Management technology. The data is sourced from:
- Agents accepting calls to the Service;
- Callers to the Service.
5. Sensitive Personal Data
Sensitive personal data reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.
Agents will not intentionally collect any sensitive personal data via the Service but responses to the questions could reveal sensitive personal data. The Service’s intention is not to process such information.
6. Who can access the information?
Personal data will be accessed by the following entities:
|Entity||Location||Purpose||Level of access|
|Pod leader at EY||Canada||Review case notes and recordings; generate/review statistical reports||Read|
|Supervisor at each of the Agents||Canada||Record/review case notes and recordings; generate/review statistical reports||Read/write|
|Agents||Canada||Record/review case notes||Read/write|
|EY Technology Team||Canada and Globally||Export data; scrub data from system; ensure availability and performance of system||Read/delete|
|AWS||Canada||Application Hosting||No access to data|
|Genesys||Canada Globally||Application support||No access to data|
|Service Now||Canada Globally||Application support||No Access to data|
|Canadian Chamber of Commerce||Canada||Generate/review statistical reports||Read|
The Agents will process personal data collected through the Service in accordance with applicable law and professional regulations in Canada. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (https://www.ey.com/en_gl/data-protection-binding-corporate-rules-program).
7. Data retention
The policies and/or procedures for the retention of data processed through the Service are:
- All data is retained only in line with the operational need as follows:
- Common Data: up to six months or the duration of the project, whichever is longer.
- Archived Data: up to six months or the duration of the project, whichever is longer.
- Log Data: up to six months or the duration of the project, whichever is longer.
- Personal data will be retained in compliance with applicable privacy laws and regulations.
There is a strong commitment on securing all data processed through the Service. To prevent unauthorized access or disclosure, EY has defined, on its own or with the platform vendors’ (Genesys, ServiceNow and AWS) support, technical and organizational measures to safeguard and secure data. All EY personnel and third parties EY engages to process personal data are obliged to respect the confidentiality of the data.
9. Controlling personal data
Personal data will not be transferred to third parties (other than any external parties referred to in section 6 above) unless we have permission or are required by law to do so.
Callers are legally entitled to request details on the processing of personal data about them.
To confirm whether personal data is processed through the Service or to access personal data in the Service, individuals may contact the Canadian Chamber of Commerce Privacy Officer through the means described in Section 12 below.
10. Rectification, erasure, restriction of processing or data portability
Individuals can confirm that their personal data collected through the Service is accurate and current. Individuals can request rectification, erasure, restriction of processing or a readily portable copy of their personal data by contacting the Canadian Chamber of Commerce Privacy Officer through the means described in Section 12 below.
If an individual is concerned about an alleged breach of privacy law or any other regulation, such individual may contact the Canadian Chamber of Commerce Privacy Officer through the means described in Section 12 below.
If an individual is not satisfied with how the complaint has been resolved, individuals have the right to complain to the appropriate data protection authority. Individuals can also refer the matter to a court of competent jurisdiction.
12. Contact us
If an individual has additional questions or concerns, individuals may contact the Canadian Chamber of Commerce Privacy Officer by:
Email: [email protected]
Telephone: 613 238 4000 (2229)
Fax: 613 238 7643
Mail: Canadian Chamber of Commerce, 1700-275 Slater Street, Ottawa, ON, K1P 5H9