Privacy Policy

1. Accountability for Personal Information

Personal information is any recorded information about an identifiable individual, and may include:

• name, address, telephone number or email address;
• birth date;
• any identifying number, symbol or other particular identifier;
• information relating to financial transactions, including credit card number or bank account information; and
• correspondence that is implicitly or explicitly of a private or confidential nature.

Pursuant to Ontario’s Freedom of Information and Protection of Privacy Act (“FIPPA”), Metrolinx is responsible for personal information in its custody or under its control.

Accountability for Metrolinx’ compliance with FIPPA and this Privacy Policy rests with Metrolinx’ President & CEO, although other individuals within Metrolinx are responsible for the day-to-day collection and processing of personal information. In addition, other individuals within Metrolinx are authorized to act on behalf of the CEO, such as the Senior Privacy Officer.

2. Consent for the Collection, Use and Disclosure of Personal Information

By submitting your personal information to Metrolinx, you give Metrolinx consent to collect, use and disclose your personal information:

• in accordance with this Privacy Policy;
• for such other purposes as may be identified to you at the time of collection; and
• for such purposes as are permitted pursuant to applicable law.

Subject to applicable law, you have the right to withdraw your consent at any time by providing written notice to us. However, please note that your withdrawal of consent may affect our ability to respond to your requests or provide services to you.

3. Collection of Personal Information

Your personal information is collected as required to enable Metrolinx to provide services and/or products to you, now and in the future. Metrolinx may collect personal information from you in person, over the telephone, by mail, by fax, or through the internet.

We may monitor and/or record telephone discussions when you call Metrolinx (or any of its divisions), to enhance customer service, for training purposes and to confirm our discussions with you. We may also operate video cameras in our facilities for the safety, security and protection of Metrolinx staff, visitors and customers as well as for the prevention and detection of criminal activity.

4. Purposes for the Collection of Personal Information

Metrolinx shall have the right to use your personal information for the following purposes:

• To provide our products and services to you, including:
• to communicate with you about our products and services;
• to verify your identity and/or eligibility for certain Metrolinx services;
• to process financial and other transactions, such as processing a fare payment or issuing a refund;
• to conduct promotional campaigns, including contests, draws, raffles, promotions and offers for third party products and services;
• to provide you with information on new or current products, services or upcoming events, including third party events sponsored by Metrolinx; and
• to conduct and administer rewards or loyalty programs.

• To manage, develop and improve our operations, products and services, including:
• to respond to comments, questions or complaints;
• to detect and prevent fraud, theft and other illegal activities;
• to enforce and administer Metrolinx rules, by-laws and policies; and
• to audit internal procedures.

• To assess, process and administer: applications for employment; injury, damage and other claims; and tenders, proposals and contracts.
• For research, statistical, planning and actuarial purposes, including:
• to analyse business results, trends and patterns; and
• to conduct market research.
• To comply with our legal and regulatory requirements and to ensure compliance with this Privacy Policy and the Website Terms and Conditions.
• For any other purpose required or authorized by law.

We may also use your personal information to create aggregated data. Aggregated data is data that is placed in a format that prevents or limits the chance of revealing an individual’s identity. It may be used to show general statistics or track customer behavior as a whole (for example, the number of customers living in a certain area). Such aggregated information is used by Metrolinx to plan, develop, implement, market and promote our services and products. It will not be used to identify you.

If we require personal information for any purpose(s) other than those set above, we will ask for and obtain your consent before using your personal information for such purpose.

5. Disclosure of Personal Information

Metrolinx may from time to time provide your personal information to third parties that we work with to provide our products and services or who have a need to know the information for one of the purposes described above. This may include circumstances where:

• aggregated data is provided to third parties for the purposes of planning, developing, implementing, marketing or promoting Metrolinx services, or for research, statistical, planning and actuarial purposes;
• disclosure is required or permitted by law or pursuant to a court order; or
• disclosure to a third party is reasonably required to facilitate the provision of our products or services.

Third parties includes various organizations with whom we work to provide products and services to you, including contractors and other service providers, affiliates, municipalities, and other government agencies. We will not transfer personal information to third parties unless they have agreed to comply with all applicable privacy standards, including this Privacy Policy and FIPPA.

6. Limiting Collection, Use, Disclosure and Retention of Personal Information

The collection of personal information will be limited to that which is necessary to fulfill the purposes identified by Metrolinx, in this Privacy Policy or otherwise.

Once collected, personal information will only be used and disclosed:

• for the purposes for which it was collected, and to which you have consented (pursuant to this Privacy Policy or otherwise), or
• as required or permitted by applicable law.

Personal information will be retained as long as it is required for the identified purposes and, thereafter, for a further period as determined by FIPPA and other applicable law. We will act in accordance with FIPPA to destroy, delete or erase your personal information from its records when it is no longer required. There may, however, be circumstances where we may not be able to completely remove your personal information, including as a result of data backup procedures or document retention policies. In these circumstances such information will continue to be held securely pursuant to this Privacy Policy.

7. Ensuring Accuracy of Personal Information

Metrolinx will take reasonable steps to ensure that your personal information is accurate, complete and up–to–date. If you wish to verify, update, remove or amend your personal information in our records, please notify us in writing at the address set out below. If you successfully demonstrate the inaccuracy or incompleteness of your personal information, we will amend your information as required. Depending upon the nature of the information challenged, amendment may involve the correction, deletion, or addition of information. Where appropriate, we will provide the corrected information to third parties that have access to your information.

8. Ensuring Safeguards for Personal Information

Security safeguards appropriate to the sensitivity of the information are used to protect personal information collected by Metrolinx against loss or theft, as well as unauthorized access, disclosure, copying, use or modification. Technical, contractual administrative and physical security measures, or a combination thereof, may be used. Metrolinx protects personal information regardless of the format in which it is held.

9. Openness about Policies and Practices

We are committed to ensuring that information about our privacy policies and practices is available to you. Metrolinx makes general information regarding its privacy policies and practises available on its website. For additional information, please contact the Senior Privacy Officer at 97 Front Street West, 2nd Floor, Toronto, Ontario M5J 1E6, (416) 202-5941.

10. Individual Access to Your Own Personal Information

Upon written request, we will confirm the existence, use and disclosure of your personal information. You may request access to your personal information at any time. Please provide sufficient information in your request to enable Metrolinx to provide an accurate account of your personal information. Depending on the nature and complexity of the request, you may be required to pay a fee (as prescribed by FIPPA) before your request can be processed.

In certain situations, Metrolinx may not be able to provide access to all personal information it holds about you. For example, we may not be able to disclose information if the record also contains references to other individuals, contains confidential information, or is subject to legal privilege. Exceptions to the access requirements are determined in accordance with applicable law, and the reasons for denying access will be provided to you.

11. Challenging Compliance

Metrolinx has procedures in place to receive and respond to complaints or inquiries about its policies and practices relating to the handling of personal information. If you believe that we are not complying with the principles set out in this Privacy Policy or FIPPA, please contact the Metrolinx Senior Privacy Officer, who will investigate your concerns. We will investigate all complaints. If a complaint is found to be justified, we will take appropriate measures to resolve the matter in accordance with applicable law.

Any questions pertaining to the privacy concerns should be addressed to:

Senior Privacy Officer

Metrolinx

97 Front Street West, 2nd Floor

Toronto, Ontario, M5J 1E6

(416) 202-5941

12. Changes

Our Privacy Policy may change from time to time; however, we will not reduce your rights under this Privacy Policy without your express consent. We will post any Privacy Policy changes on our websites and, if the changes are significant, we will provide a more prominent notice (including, for certain services, an email notification of changes to this Privacy Policy). We will also keep prior versions of our Privacy Policy in an archive for your information.

“Personal information” is any recorded information about an identifiable individual. Examples of personal information include:

• your name, address, birth date, address, email address, and telephone number
• financial information, such as credit or debit card information or bank account information, used to process pre-authorized payments for PRESTO or reserved parking
• correspondence describing a personal experience with a Metrolinx service, and replies to that correspondence
• personal opinions or views expressed in a letter or email to Metrolinx
• demographic information collected as part of a survey
• language preference provided when you register your PRESTO card
• information relating to your education or employment history, collected when you apply to work at Metrolinx

Any data that has been collected in which all personal identifiers have been removed, making determination of your identity impossible, is not personal information. Also, your job title, business address and business telephone number are not personal information.

We need to collect personal information from you from time to time in order to provide our services to you, to promote our services, to make our services better and to operate our business in accordance with legal requirements. Our practice is to collect only the information that we need.

The type of information we collect depends on the Metrolinx services you choose to use. For example:

• We may collect your name and email address so that we can correspond with you, or respond to your questions.
• If you choose to register your PRESTO card, we may collect your name, address, email address, and birth date.
• If you choose to reload your PRESTO card online, we may collect financial information from you.
• We may collect your name, address, email address or other personal information when you enter a contest or wish to take advantage of a promotion sponsored by Metrolinx.
• More detailed information may be required if you receive a fare infraction or otherwise violate any of GO Transit’s rules. In this case, GO Transit transit enforcement officers may need to collect your name, address, telephone number and birth date.

We may collect personal information from you in person, over the telephone, by mail, email or fax or through the internet. This Privacy Policy applies regardless of the method of collection.

More specific information about what information we collect and why can be found in our Privacy Policy, or on the website for the specific service you intend to use.

We only use your personal information for the purposes identified in Section 4 of our Privacy Policy, or for purposes specifically identified to you at the time the information is collected. We may further use such information to develop and customize products and services to better meet your needs and preferences, and to offer you products and services from Metrolinx, including any divisions within Metrolinx.

Your personal information is only made available to those people who require access to your information for the purposes specified in Section 4 of our Privacy Policy. This includes certain Metrolinx employees. We may also from time to time disclose your information to our third party service providers who need the information to provide services to you on our behalf.

We make sure our employees and service providers are fully aware of our Privacy Policy and the requirements of the Freedom of Information and Protection of Privacy Act, and ensure that appropriate safeguards are in place to protect your personal information. We ensure that service providers who will have access to personal information are bound by contractual terms requiring them to clearly comply with our Privacy Policy and the requirements of the Freedom of Information and Protection of Privacy Act.

Metrolinx may also be required to disclose your personal information to people outside of Metrolinx for legal or regulatory reasons. Such disclosure is governed by the Freedom of Information and Protection of Privacy Act.

We use a variety of means to protect your personal information. Depending on the type of information, these may include any or all of the following:

• Technical safeguards, such as the use of passwords, encryption and firewalls;
• Physical safeguards, such as facility access controls, workstation security, placing written information in locked filing cabinets, and mobile device security requirements, as and when required;
• Administrative safeguards, such as requirements for employee security clearances and limiting access on a "need-to-know" basis.

We make every effort to ensure that these safeguards not only comply with the Freedom of Information and Protection of Privacy Act but also, where appropriate, reflect current trends and privacy best practices/industry standards.

Yes. For a listing of all Personal Information Banks maintained by Metrolinx, please visit the Directory of Records maintained by the Ministry of Government Services.

The Freedom of Information and Protection of Privacy Act (FIPPA) defines a Personal Information Bank as “a collection of personal information that is organized and capable of being retrieved using an individual’s name or an identifying number or particular assigned to the individual”.

Metrolinx will keep your personal information for as long as the information is required for the identified purpose(s). After that, Metrolinx is required to retain your personal information for a further period as determined by the Freedom of Information and Protection of Privacy Act and other applicable law.

We will collect, use and disclose your personal information only with your knowledge and consent, except where required by law. Whenever you provide information to us, we ask for your consent to use your personal information generally for the purposes described in Section 4 of our Privacy Policy. This includes your consent to use your personal information for the purposes specified. In practice, before using your information, Metrolinx will consider the circumstances in which it was provided and the sensitivity of the information.

If you do not want Metrolinx to use your personal information, you may choose not to provide it to us or you may withdraw your consent at any time by providing written notice to us; however, this may affect our ability to respond to your requests or provide services to you.

Yes. If you wish to access or update the information we have about you, please contact Metrolinx’ Senior Privacy Officer at the address listed below.

If you have a question about our Privacy Policy or our use of your personal information, please contact Metrolinx’ Senior Privacy Officer at the address listed below.

Senior Privacy Officer

Metrolinx

97 Front Street West, 2nd Floor

Toronto, Ontario, M5J 1E6

(416) 202-5941

To make a freedom of information request, please contact Metrolinx’s Freedom of Information Office at the address listed below:

Metrolinx

Freedom of Information Office

20 Bay Street, 6th Floor

Toronto, Ontario

M5J 2W3

FOI@metrolinx.com

(416) 202-7382

If you have a question about our Privacy Policy or our use of your personal information, please contact Metrolinx’s Privacy Office:

Privacy Office

Metrolinx

97 Front Street West, 3rd Floor

Toronto, Ontario, M5J 1E6

privacyoffice@metrolinx.com

Freedom of Information

For information on how to make a Freedom of Information Request, please visit our Freedom of Information request page or contact Metrolinx’s Freedom of Information Office at FOI@metrolinx.com.