G. RETENTION KEY REQUIREMENTS:

Personal information should be retained for at least one year after use to provide the individual with a reasonable opportunity to access their personal information.

The individual's consent should be obtained in order to dispose of personal information prior to one year after use. Planning for Success: Privacy Impact Assessment Guide 45

Ensure compliance with other relevant records retention laws, regulations, bylaws or other requirements.

See MFIPPA section 30(1) and Ontario Regulation 823, section 5; FIPPA section 40(1) and Ontario Regulation 460, section 5

FINDINGS PRIVACY REQUIREMENT Y N P NA EXPLANATION PRIVACY IMPACT ACTION ITEMS QUESTIONS RETENTION SCHEDULES Will there be defined and documented policies, procedures, and other requirements related to the retention of personal information? REASONABLE OPPORTUNITY FOR ACCESS Will measures be in place to ensure that personal information will be retained for a minimum of one year after its last use? MEDIUM AND LOCATION OF RETENTION Has the medium and format of the personal information to be retained been defined? RETENTION PERIOD If the personal information has not been used, will it be retained for only as long as necessary to meet its purpose? CONTROLS Will procedures be defined and documented related to consent for early disposal of personal information? Will there be periodic reviews of the retention requirements and consent procedures to ensure effectiveness