Last Updated: August 25, 2026 TRAVEL MANITOBA PRIVACY POLICY By using the Travel Manitoba Website (www.travelmanitoba.com) or any of Travel Manitoba's online or app properties (including without limitation: www.everythingchurchill.com, www.huntfishmanitoba.ca, anglers.travelmanitoba.com, hunters.travelmanitoba.com, industry.travelmanitoba.com, shoptravelmb.ca, shophuntfishmb.ca, the Manitoba Master Angler App and Manitoba Explorer), you are deemed to have agreed to be bound by this Privacy Policy and by our by Website/App Privacy Code. We may update this Privacy Policy and our Website/App Privacy Code at any time, and will provide you with notice by updating the "Last Updated" date at the top right corner of this first page of this Privacy Policy and on the top right corner of the landing page of the Website/App Privacy Code. All updates are effective upon being posted. Your continued use of our website and/or other online properties will be deemed to be your acceptance of the updated Travel Manitoba Privacy Policy, as well as to our Website/App Privacy Code should you use our website or online services. Travel Manitoba values your privacy At Travel Manitoba, your privacy is important to us. Travel Manitoba provides diverse services and has established online and app properties to highlight our programming and to provide users with information concerning news, events and travel and tourism brochures, information, opportunities and activities. We may collect personal information from you directly or through our websites and in connection with our programs, services, product sales and undertakings. We may also collect personal information from you to facilitate and administer purchases through our E-Shops. Travel Manitoba is bound by the provisions of The Freedom of Information and Protection of Privacy Act (Manitoba) ("FIPPA") and, to the limited extent that we have any personal health information under our custody and/or control, we are also subject to The Personal Health Information Act (Manitoba) ("PHIA"). Where Travel Manitoba, including through its agents, collects, uses or discloses personal information to facilitate product ordering, delivery and payments as part of the E-Shop(s) or to carry on other commercial activities, we also adhere to the provisions of the Personal Information Protection and Electronic Documents Act (Canada). This Privacy Policy reflects our legal obligations and outlines the manner in which we collect, use, disclose, safeguard, administer and destroy personal information under our
control. This Privacy Policy also sets out the processes and procedures that Travel Manitoba will follow in responding to requests for access to personal information, to have records containing personal information corrected, and any complaints concerning our privacy practices. This Privacy Policy also details the processes and procedures that Travel Manitoba will follow in the unlikely event of a privacy breach. About Travel Manitoba Travel Manitoba is a corporation established under The Travel Manitoba Act and is a public body under Manitoba law. Travel Manitoba works to foster development, growth and diversity in the travel and tourism industry in Manitoba. Travel Manitoba is responsible for, amongst other activities, tourism marketing, visitor information services, tourism research and public information. We work regularly in cooperation with third parties in the travel and tourism industry to showcase some of the finest resources, events and activities that Manitoba has to offer. We may partner, collaborate or work cooperatively with third parties to deliver our services and programming. We have established our E-shops to further promote Travel Manitoba and Hunt Fish Manitoba programming. What is "personal information"? For the purposes of this Privacy Policy, "personal information" has the meaning set under applicable law but includes information about an identifiable individual. Personal information includes, for example, an individual's name, address, telephone number, email address, and all manner of information concerning the subject individual but does not include business contact information when used for that purpose. What is "personal health information"? "Personal health information" has the meaning set under applicable law, but includes without limitation recorded information concerning the personal health, health care history or other health-related information concerning an identifiable individual. What is not "personal information"? Personal information is limited to information about identifiable individuals. Personal information does not include corporate information or business contact information. Information that is statistical, truly anonymized or cannot be analyzed to be attributable to any identifiable individual is also not "personal information" for the purposes of this Privacy Policy. Travel Manitoba reserves the right to utilize statistic-gathering services and/or analytic services to analyze and optimize use of programs, services, our apps and our website(s). Statistics and analytics are not considered to be "personal information" for the purposes of this Privacy Policy. Additional Policies That Form Part of This Privacy Policy
Travel Manitoba has established additional policies for defined areas of its programming and service offerings that detail its privacy practices for those areas and which may be different than as set out in this Privacy Policy. These additional policies are incorporated into and form part of this Privacy Policy for their defined business uses, namely: (a) Website and App Privacy Code Travel Manitoba has established a Website/App Privacy Code to address our online and app collection and administration practices. When using the Travel Manitoba Website (www.travelmanitoba.com) or any of Travel Manitoba's online or app properties including without limitation: • • • • • • • • •
www.everythingchurchill.com, www.huntfishmanitoba.ca, anglers.travelmanitoba.com, hunters.travelmanitoba.com, industry.travelmanitoba.com, shoptravelmb.ca, shophuntfishmb.ca, the Manitoba Master Angler App, and Manitoba Explorer
users are deemed to have agreed to be bound generally by this Privacy Policy and also by our by Website/App Privacy Code. In respect of our E-Shops, the Terms of Use also apply.
(b) Cookies Travel Manitoba’s website does not collect any personally identifiable information through the use of electronic cookies; Travel Manitoba reserves the right to use electronic systems or online resources or service providers that do utilize cookie technology in applications to improve your service experience or evaluate Travel Manitoba websites and resources. Users are encouraged to actively monitor their cookie settings and may disable the use of same as appropriate.
(c) Records Retention and Security Policy Travel Manitoba has adopted a Records Retention and Security Policy to detail its required safeguards to protect personal information and personal health information under its custody and/or control from unauthorized access, collection use, disclosure or destruction. The Travel Manitoba Records Retention and Security Policy shall be
reviewed on a bi-annual basis. Retention and security matters are also addressed under Part 1.4 of this Privacy Policy.
Appointment of Access and Privacy Coordinator 1 Appointment of Access and Privacy Coordinator. In accordance with applicable law, Travel Manitoba has appointed an Access and Privacy Coordinator to oversee its organizational compliance with privacy requirements and this Privacy Policy. The Access and Privacy Coordinator can be contacted by contacting Travel Manitoba or by dedicated email at: fippaTMB@travelmanitoba.com 2. The Travel Manitoba Access and Privacy Coordinator may delegate certain of his/her/their tasks to approved and designated employees of Travel Manitoba from time to time. Employees, contractors or other parties working on behalf of Travel Manitoba shall comply with this Privacy Policy and as directed by Travel Manitoba from time-totime. 3. Any questions or concerns relating to this Privacy Policy should be referred to the Access and Privacy Coordinator. In particular, the Access and Privacy Coordinator should always be consulted in the following cases (the list below is by way of example and is not exhaustive): • Collection - if there is any uncertainty relating to the lawful basis on which personal information or personal health information is to be collected, used, stored or disclosed; • Reliance on Implied Consent – Travel Manitoba requires express consent wherever possible. If implied consent is being relied upon in order to collect, use, store or disclose personal information or personal health information, seek the direction of the Access and Privacy Coordinator; • Information Concerning a Minor - any collection of personal information or personal health information from or concerning an individual below the age of majority; • Retention Period - if there is any uncertainty relating to the retention period for any particular type(s) of personal information or personal health information; • Privacy Notices - if any new or amended privacy notices or similar privacyrelated documentation is/are required; • Dealing with Representatives - if someone is requesting access to personal information or personal information of another individual, that request should be referred to the Access and Privacy Coordinator for direction. Status and authority of the individual to such third-party information (for example where the applicant is the executor, power of attorney or parent/legal guardian of the subject of the request) and has official documentation proving status or a verified consent from the subject individual; • Concern about Security Measures - if there is any uncertainty relating to security measures (whether physical, technological or organizational) required to protect personal information or personal health information;
• •
•
• •
New Purposes Need a New Consent - when personal information or personal health information is being used for a purpose or purposes different to those for which it was originally collected and additional consent may be required; Breach or Suspected Breach - if a personal information/personal health information breach – namely unauthorized access, collection, use, disclosure or destruction – whether suspected or actual, has occurred or is suspected to have occurred; Disclosure to Service Providers / Information Managers - if personal information/personal health information is to be shared with third party service providers or information managers, appropriate contractual protections must be in place in advance and agreed to by the parties; Disclosure/Transfer Outside of Canada - if personal information/personal health information is to be transferred outside of Canada and there are questions relating to the legal basis on which to do so; and Use of Personal Information for Marketing or Like Purposes - any questions or concerns in respect of Canadian Anti-Spam Legislation and privacy compliance.
4. The Access and Privacy Coordinator (including through his/her/their delegates) is responsible to oversee Travel Manitoba's privacy compliance by coordinating: • day-to-day organizational privacy compliance of Travel Manitoba; • privacy training of Travel Manitoba and its staff (onboarding, off-boarding and during the course of employment/contract service provision); • proper practices to carry out undertakings and activities in compliance with this Privacy Policy, additional policies and Travel Manitoba's obligations at law; • the answering of privacy compliance questions from staff as appropriate; • responses to client and third party questions concerning Travel Manitoba's privacy practices; • responses to access requests and correction requests regarding records under Travel Manitoba's custody or control; • review, investigation and responses to complaints concerning Travel Manitoba's privacy practices in consultation with and at the direction of the Board of Directors or their delegate; • Travel Manitoba's responses to any privacy breaches and reporting as required, and responding to any investigations by Manitoba Ombudsman and/or the Office of the Privacy Commissioner of Canada, all in consultation with and as directed by the Chief Executive Officer; • reporting to the Chief Executive Officer as and when directed on privacy compliance issues, and forthwith on access requests, correction requests and complaints; • conduct an annual review of this Privacy Policy to ensure that this Policy reflects Travel Manitoba's legal obligations and current industry practices in respect of program delivery, undertakings and events and personal information practices, and recommend updates to the Board of Directors as appropriate;
• •
the circulation of an update notice to staff should the Chief Executive Officer approve the amendment of this Privacy Policy from time to time in a manner that would affect staff compliance obligations; such other privacy duties as are reasonably necessary or assigned from time to time.
5. As required under applicable privacy laws, the identity of Travel Manitoba's Access and Privacy Coordinator (namely his/her/their name, in addition to his/her/their title and contact information) shall be made known upon request. 6. The Travel Manitoba Access and Privacy Coordinator shall, as part of his/her/their duties review or cause the Privacy Policy to be reviewed annually to address any needed policy or practice changes, and shall cause an audit of security safeguards (including under the Records Retention and Security Policy) to be conducted at least every two (2) years in accordance with privacy law requirements.
Training and Staff Obligations In Respect of Personal Information and Personal Health Information 1. Travel Manitoba understands the importance of staff training to ensure privacy compliance and shall take reasonable steps to ensure that its staff receive appropriate training in respect of Travel Manitoba's privacy obligations and practices and in terms of this Privacy Policy (including without limitation additional policies which are incorporated by reference to this Privacy Policy). 2. In its commitment to informed consent, Travel Manitoba shall take steps to ensure that its staff collecting personal information are able to explain the purposes for which personal information/personal health information is collected and to answer general questions. 3. All Travel Manitoba staff are required to carefully review this Privacy Policy and to provide the Confidentiality and Privacy Agreement in the form set out in Schedule "A" to this Privacy Policy. 4. Travel Manitoba shall enter into written contracts (which shall contain without limitation confidentiality restrictions) with independent contractors who are processing personal information on behalf of Travel Manitoba, binding such contractors to Travel Manitoba's privacy practices and compliance with Privacy Policy requirements, including as may be updated from time to time. 5. Travel Manitoba shall ensure that any new staff members are trained in respect of Travel Manitoba's Privacy Policy as soon as practicable upon hiring. 6. Where reasonably necessary and taking into account employee/contractor duties, Travel Manitoba shall provide privacy updates and training as appropriate to ensure personnel privacy training remains up-to-date in respect of current practices.
7. In the event of substantive changes or updates to this Privacy Policy or organization privacy practices, the Travel Manitoba Access and Privacy Coordinator shall cause a notice of update summarizing the change requirements to Travel Manitoba personnel as appropriate.
Reporting 1. In order to ensure that Travel Manitoba has the ability to appropriately respond to access requests, correction requests and/or complaints, all directors, officers, employees and independent contractors of Travel Manitoba shall, on the same business day and without delay, report any of the following to the Access and Privacy Coordinator (or to his/her/their delegate): A. any request for access to records or for correction of records under the custody or control of Travel Manitoba; B. any complaints concerning Travel Manitoba or its privacy practices or those of any of its contractors or agents; and/or C. any known or suspect violations of privacy, safeguards or this Privacy Policy or breaches of confidentiality in respect of personal information and personal health information. The request or complaint shall be date stamped by Travel Manitoba upon receipt if not otherwise expressly stated on the access or correction request form or other such document. 2. The Access and Privacy Coordinator shall provide the following reports to the Travel Manitoba Chief Executive Officer in respect of personal information under the custody and/or control of Travel Manitoba: A. regular quarterly reports on matters that are not of an urgent nature (namely not in violation of this Privacy Policy, other Travel Manitoba policies or procedures or applicable law) and detailing the following information: • staff training provided and any training to be provided that has not been completed; • any identified non-urgent organizational privacy compliance issues to be addressed and a proposal and timeline to address same for consideration by the Chief Executive Officer; • any recommendations for changes to best practices; • any privacy practice or Privacy Policy change recommendations; • reports on requests for access to information, if any, confirmation of responses, and response timelines (report to contain no personal information); • updates on requests for correction, responses and response timelines,
if any (report to contain no personal information); • updates concerning approved privacy complaints and responses, if any. B. reports delivered within two (2) business days for privacy complaints (that do not address a privacy breach) concerning Travel Manitoba that do not have any immediate requirements for response; C. reports delivered immediately upon becoming aware of a privacy breach involving Travel Manitoba staff or otherwise in respect of personal information under Travel Manitoba's custody and/or control. Reports on privacy breaches shall be updated on a timeline to be set by the Chief Executive Officer following the initial reporting of the privacy breach. 3. The Access and Privacy Coordinator shall also take steps to retain copies of all versions of this Privacy Policy with in-force dates confirmed, for confirmation of Travel Manitoba's privacy policies and practices to assist the organization in documenting its practices, and to respond to and address any complaints or claims.
PART 1 – Table of Contents This Privacy Policy is separated into the following Parts: 1) Part 1 – Table of Contents 2) Part 2 - Protection of Privacy 3) Part 3 – Privacy Breaches 4) Part 4 – Requests for Access to Information 5) Part 5 – Requests for Correction 6) Part 6 – Inquiries and Complaints 7) Part 7 – Schedules: (i) Schedule "A" - Confidentiality and Privacy Agreement (ii) Schedule “B” - Access Request Form
Part 2 – Protection of Privacy 1. Application of this Policy and Collection of Personal Information 1.1 Third Party and Employee Personal Information. This Privacy Policy applies to both third party personal information and employee personal information, and to the personal health information of such persons as applicable. 1.2 Collection. 1.2.1. Limited Collection. (a) Restrictions on Collection. Travel Manitoba only collects personal information and personal health information that is reasonably necessary to carry out and administer its services, programs, activities and undertakings. In respect of personal information only, the subject individual or his/her/their parent/legal guardian or lawful representative, may choose to provide additional personal information to Travel Manitoba, however this additional information is collected only with consent and for defined purposes. Travel Manitoba shall identify when the collection of personal information is optional, as applicable, and will not withhold a product or service in respect of optional personal information unless same is required for product or service delivery. Travel Manitoba is not permitted to collect personal health information about an individual beyond what is required to complete the purpose for which it is collected. (b) Types of Personal Information Collected May Vary. The types of personal information collected by Travel Manitoba vary by service type and program undertaking. 1.2.2. Sources of Collection. Travel Manitoba collects personal information and personal health information directly from the subject individual where reasonably possible. Travel Manitoba will only collect personal information or personal health information about individuals from a third party with the consent of the subject of the information unless required/permitted by law. 1.2.3. Collection of Personal Information from Minors with Consent. Travel Manitoba does not knowingly collect personal information or personal health information from individuals below the age of 18 years without consent of a parent, legal guardian or lawful representative. 1.2.4. Purposes to Be Specified. In collecting personal information and personal health information, Travel Manitoba shall inform the subject individual or his/her/their lawful representative of the following at or prior to the time of collection, in writing where reasonably possible: (a) the purpose for which personal information is being collected; (b) the legal authority for the collection; and
(c) the title and contact information of the Travel Manitoba Access and Privacy Coordinator who can answer questions about the collection. 1.2.5. Purposes Do Not Need To Be Specified Again Where Recently Provided. Where Travel Manitoba has collected the same or similar personal information or personal health information from an individual, Travel Manitoba is not required at law to specify the same purposes on collection of the same or similar personal information or personal health information for the same or a related purpose. Any questions concerning the collection of personal information under this paragraph 1.2.5. shall be directed to the Access and Privacy Coordinator prior to collection. 1.2.6. Purposes To Be Recorded. Travel Manitoba shall, wherever possible, document purposes for collection in writing and in standardized forms or through specific materials, and shall cause its records to reflect that purposes were specified to the subject individual at or prior to the time of collection. Where such forms or written materials are not in use, Travel Manitoba staff shall: (a) specify purposes and document in writing the delivery of such purposes in writing; (b) time stamp the record; (c) update the subject individual's records to reflect the delivery of information concerning purposes. Where Travel Manitoba staff are relying on paragraph 1.2.5. of this Privacy Policy, Travel Manitoba staff shall document same in the subject individual's file. 1.3. Accuracy. If personal information or personal health information will be used by Travel Manitoba to make a decision that directly affects the subject individual, and where there has been delay between the time of collection and the time of use, Travel Manitoba shall take reasonable steps to ensure that the information is accurate and complete for the purpose for which it was collected. 1.4. Retention and Security. 1.4.1. Retention Period. Travel Manitoba retains records containing personal information and personal health information for a reasonable period, as determined by Travel Manitoba from time-to-time for relevant records, or where a period is not otherwise identified, then for a period of seven (7) years from the document date. Retention periods shall be set to provide subject individuals with a reasonable opportunity to access his/her/their personal information/personal health information, and to allow for the expiration of applicable legal and taxation limitation periods. Notwithstanding the foregoing, where an individual informs Travel Manitoba that individuals opt-out of contacts, Travel Manitoba will retain e-mail information to ensure that such opt-out is respected.
1.4.2. Travel Manitoba has adopted reasonable physical, technical and administrative safeguards in compliance with legal requirements against risks such as unauthorized access, collection, use, disclosure and destruction of records containing personal information and personal health information. Travel Manitoba has established a Records Retention and Security Policy to ensure confidentiality, security, accuracy and integrity of the information, and which is incorporated by reference and forms part of this Privacy Policy. Access to the Records Retention and Security Policy may be restricted in respect of security considerations. 1.4.3. Contractors and Service Providers. Travel Manitoba may, from time to time, contract with third party independent contractors and service providers for the receipt or provision of products and services. Travel Manitoba shall enter into written agreements with all contractors and service providers that may have access to records containing personal information and personal health information controlled by Travel Manitoba, to bind contractors and service providers to comparable privacy practices and to protect against risks of unauthorized access, use, disclosure, destruction or alteration. 1.4.4. Information Managers. (a) Travel Manitoba may use the services of third-party information manager(s) to: (i) process, store and/or destroy its records containing personal information and personal health information and/or (ii) to receive information management or information technology services. (b) Travel Manitoba shall enter into written agreements with all information managers it retains and such agreements shall provide for the protection of personal information and personal health information against risks of unauthorized access, use, disclosure, destruction or alteration, in the same manner and to the same degree as is required of Travel Manitoba at law and in accordance with this Privacy Policy. (c) Information held by the information manager on Travel Manitoba's behalf is deemed to have remained within the custody and control of Travel Manitoba and does not constitute a disclosure to a third party at law.(d) Information managers may only use and disclose personal information and personal health information to carry out the purposes for which that information was collected by Travel Manitoba or for a consistent purpose. 1.5. Restrictions on Use and Disclosure of Personal Information. Travel Manitoba only uses and discloses personal information and personal health information as reasonably necessary to carry out its services, programs, activities and undertakings, including without limitation for requested information and program participation. 1.5.1. Restrictions on Use. Travel Manitoba has instituted policies that limit the use of personal information and personal health information to those of its personnel that require access to same to carry out their assigned duties and: (i) in order to carry out the purposes for which the personal information/personal health information was collected and any use
consistent with that purpose, (ii) any additional uses where the subject individual has consented to same, and (iii) as otherwise permitted by law. 1.5.2. Restrictions on Disclosure. Travel Manitoba shall only disclose personal information or personal health information with your consent, unless required or permitted by law. 1.6. Consent 1.6.1. Consent relied upon by Travel Manitoba may be express written consent or implied consent. Express written consent should be obtained wherever possible and should be relied upon where personal information or personal health information is of a sensitive nature. 1.6.2. Travel Manitoba shall develop forms where reasonable to collect personal information and to ensure consistent messaging in respect of purposes for which personal information is collected, used and disclosed by Travel Manitoba. 1.6.3. In collecting personal information, Travel Manitoba shall take steps to inform subject individuals of the purposes for which personal information will be collected, used and disclosed if same is not expressly set out under paragraph 1.6.2. above. Travel Manitoba shall make available the contact information for its Access and Privacy Coordinator or other designated employees who can answer questions about the subject individual's personal information and the collection and administration of same by Travel Manitoba, or in respect of Travel Manitoba's records and privacy practices generally.
PART 3 – PRIVACY BREACHES 1.0. Privacy Breach 1.1. Privacy Breach - Meaning. A "privacy breach" means in relation to personal information or personal health information: (a) theft or loss; or (b) unauthorized access, use, disclosure, destruction or alteration in breach of Travel Manitoba's obligations at law or this Privacy Policy. 1.2. Notification Required Where Real Risk of Significant Harm. As a public body, and in the unfortunate and unlikely event of a privacy breach, Travel Manitoba is required to conduct a review of the breach and to notify affected persons, if, after considering the relevant factors at law, the breach could reasonably be expected to create a real risk of significant harm to the subject individuals. Factors for consideration of whether a breach incident meets the standard of “real risk of significant harm” are set out in paragraph 1.3 below and at law. "significant harm" is defined at law to include in relation to an individual: bodily harm, humiliation, damage to the individual's reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the individual's credit rating or reporting, and damage to or loss of the individual's property. 1.3. Consideration of Factors in Determining Significant Harm. Travel Manitoba is required at law to consider the following relevant factors in determining whether the facts of a breach in respect of personal information/personal health information create a real risk of significant harm: (a) the sensitivity of the personal information/personal health information involved; (b) the probability that the personal information/personal health information could be used to cause significant harm to the individual, having regard for (i) the event that caused the privacy breach to occur, including whether there is evidence of any malicious intent, such as the breach being the result of theft or gaining unauthorized access to a computer system, (ii) the number of persons who actually or potentially accessed the personal information/personal health information, (iii) if the identity of the persons who actually or potentially accessed the personal information/personal health information is known or unknown, (iv) any known relationship between any of the persons who actually or potentially accessed the personal information/personal health information and the individual to whom the information relates, and the nature of the relationship,
(v) if the public body is reasonably satisfied that any person who actually or potentially accessed the information has destroyed any unauthorized copies of it and has committed to not use or disclose it, (vi) the length of time since the privacy breach first occurred and the duration of the period in which the personal information/personal health information was available to be accessed, used, disclosed, destroyed or altered in contravention of the Act, (vii) the amount of personal information/personal health information involved, (viii) if the personal information/personal health information has been recovered, (ix) if the personal information/personal health information was adequately encrypted, anonymized or otherwise not easily accessible, and (x) if harm has materialized; and (c) any other factors that are reasonably relevant in the circumstances. 1.4. Breach Notifications. 1.4.1. Notice – As Soon As Practicable. (a) Notice to affected persons (in writing) will be provided as soon as practicable after the privacy breach becomes known to Travel Manitoba unless otherwise required or permitted by law. (b) Where Travel Manitoba reasonably believes that the delay necessary to provide notice in writing is likely to significantly increase a real risk of significant harm to affected individuals or where Travel Manitoba does not have a mechanism to provide notice of the breach in writing, then Travel Manitoba may determine to provide notice orally, provided that: (i) at the time the oral notice is given, Travel Manitoba causes the following information to be recorded: (i) the names of the individuals participating in the conversation, (ii) the title of Travel Manitoba personnel, (iii) the date and time the conversation occurred, (iv) the names and status of any witnesses in attendance and consent of the affected individual to attendance of such individuals, (v) details of the information that was provided by Travel Manitoba to the affected individual. Any additional information to be provided to the affected individual shall also be noted. Travel Manitoba shall not need to record the above where Travel Manitoba gives notice in writing to the affected individual in accordance with paragraph 1.4.1.(a) above within a reasonably time after the oral notice is provided. Any subsequent notice as contemplated here shall reference the delivery of the oral notification.
(c) Notification may be given by indirect means to one or more individuals where: (i) Travel Manitoba reasonably believes that the privacy breach may result in a risk to public health or safety; (ii) the identity or current contact information of the individual or individuals is unknown; (iii) if Travel Manitoba reasonably believes giving notice to an individual is impractical or unduly expensive because of the large number of individuals that may have been affected by the privacy breach or could threaten or harm the individual's mental or physical health. In such a circumstance, notice may be given by public communication or similar measures that can be reasonably expected to reach the affected individual or individuals, and does not include any information that could reasonably identify the affected individual(s), or alternatively if notice of the privacy breach can be reasonably expected to threaten or harm the recipient's mental or physical health, notice can be provided in writing to an individual who provides care to the recipient or to an individual with whom the recipient is known to have a close personal relationship. 1.4.2. Content of Notice. The notice to affected individuals shall contain the following: (a) a description of the circumstances of the privacy breach; (b) the date or period of time that the privacy breach occurred, or is believed to have occurred; (c) that Travel Manitoba had custody or control of the personal information at the time of the privacy breach; (d) a description of the personal information that was the subject of the privacy breach; (e) a description of the steps that Travel Manitoba has taken or is intending to take, as of the date of the notice, (i) to reduce the risk of harm to the individual as a result of the privacy breach, and (ii) to reduce the risk of a similar privacy breach in the future; (f) a description of the steps that the individual can take to reduce the risk of harm that can result from the privacy breach or to mitigate that harm; (g) a statement that the Manitoba Ombudsman generally and/or the Privacy Commissioner of Canada (in respect of commercial activities only) has been or will be given notice of the privacy breach; (h) the name and contact information of the Access and Privacy Coordinator who is able to answer questions about the privacy breach; and (i) any other information that Travel Manitoba considers relevant.
1.4.3. In the event that it is necessary to notify affected individuals of a privacy breach, Travel Manitoba has a corresponding obligation to notify the Manitoba Ombudsman of the breach, or the Privacy Commissioner of Canada where PIPEDA applies. PART 4 – REQUESTS FOR ACCESS TO INFORMATION AND RESPONSES 1. Duties of Travel Manitoba – Access Requests To Records 1.1. Duty to Assist. Travel Manitoba has a duty to assist an applicant in making an access request. 1.2. Duty to Assess and Respond. Subject to Travel Manitoba's obligations in respect of mandatory and discretionary exceptions to disclosure of records at law, Travel Manitoba shall respond without delay openly, accurately and completely, in respect to requests for access to records under the custody and/or control of Travel Manitoba. 1.3. Specific Considerations - Records Containing Personal Health Information under this Part 4, Paragraph 4. Response considerations for additional considerations for personal health information are specifically addressed in Part 4, Paragraph 4 below. 2. Right to Request Access to Records. 2.1.1. (A) Right to Request. You have a right to request access to records, including records containing your own personal information or personal health information or of a third party where you are the legal representative of a third party and can prove same, where those records are under the custody or control of Travel Manitoba, subject to the limitations set out in the Privacy Policy and applicable laws. Requests for access to records containing personal information and personal health information shall be made in writing (except as indicated in paragraph 3 of this Part 4 below) and must contain sufficient detail to allow Travel Manitoba to identify the requested records with reasonable effort. Subject to paragraph 3 of this Part 4, Travel Manitoba reserves the right to require individuals to use the Access Request form set out in Schedule "B" to this Policy in respect of any access request. 2.1.1.(B) Notwithstanding paragraph 2.1.1. (A) above, Travel Manitoba may disregard a request for access if Travel Manitoba is of the reasonable opinion that: (a) the request is trivial, frivolous or vexatious; (b) the request is for information already provided to the applicant; (c) the request amounts to an abuse of the right to make a request because it is: (i) unduly repetitive or systematic, (ii) excessively broad or incomprehensible, (iii) otherwise not made in good faith; or (d) responding to the request would unreasonably interfere with Travel Manitoba's operations.
In making a decision in respect of paragraph 2.1.1.(B)(c) or 2.1.1.(B)(d) above, Travel Manitoba shall take into account (i) the number of requests made by the same applicant, or (ii) whether the request is reasonably related to requests that have been made by two or more applicants who are associated with one another. 2.1.1. (C). Travel Manitoba may, in applying the provisions of this Privacy Policy, consider two or more applicants to be associated if it reasonably believes that they have acted in concert in making one or more requests for access, including considering: (i) the identity of the applicants and any known relationship between them, (ii) any commonality of employment shared by the applicants; and/or (iii) any commonality of interests shared by the applicants, including memberships in or affiliations with the same or similar organizations or entities. 2.1.1.(D). In making a determination under paragraph 2.1.1.(B)(c) or 2.1.1.(B)(d) above, Travel Manitoba in responding to the applicant shall indicate: (a) that the request is refused and the reason why; (b) the reasons for Travel Manitoba's decision; and (c) that the applicant may make a complaint to the Manitoba Ombudsman about the refusal. 2.1.2. Additional Information. Travel Manitoba may, through its Access and Privacy Coordinator, require an applicant to provide additional information necessary to identify requested records under paragraph 2.1.1.(A) above; requests for additional information must be made in writing. Should the applicant fail to respond within thirty (30) days from the date of the request for additional information, then the request for access shall be deemed to be abandoned. 2.1.3. Notification if Deemed Abandoned. In the event that the access request is deemed abandoned under paragraph 2.1.2. above, the Access and Privacy Coordinator shall notify the applicant in writing of the determination that the request for access has been abandoned and the right to make a complaint to the Manitoba Ombudsman. 2.2. Date Recorded. Travel Manitoba staff shall date stamp the request on delivery if delivered in person or through means of delivery that do not automatically record the delivery date on delivery (such as email delivery or facsimile delivery which show the transmission date, for example). 2.3. Access Requests Receipt by Travel Manitoba. Written requests for access to records can be received by personal delivery, email or fax delivery. Only fully completed and signed requests for access to records will be processed. In the event a request is received and is incomplete, Travel Manitoba shall advise the applicant of the foregoing as soon as possible. 2.4. Dedicated email. Travel Manitoba shall establish a dedicated email address to which access requests/corrections/complaints regarding privacy practices for Travel
Manitoba, which account will be available to the Travel Manitoba Access and Privacy Coordinator, and/or such other individuals as delegated to assist on privacy matters by Travel Manitoba and under the supervision of the Access and Privacy Coordinator. 2.5. Travel Manitoba staff shall, upon receipt, within the same business day transmit the request for access to personal information to the Travel Manitoba Access and Privacy Coordinator. 2.6. Oral Request for Access to Records in Limited Circumstances. 2.6.1. Notwithstanding the general requirement for access requests to be made in writing (paragraph 2.1.1.(A) above, an applicant can make an oral request for access to a record held by Travel Manitoba where the applicant: (i) has a limited ability to read or write in English or French; or (ii) has a disability or condition that impairs his or her ability to make a written request. 2.6.2. Travel Manitoba staff shall transcribe the oral request in writing, indicate his/her/their name as the receiving Travel Manitoba staff member, date stamp the transcribed request, and submit such request on the same business date on behalf of the applicant to the Travel Manitoba Access and Privacy Coordinator. 2.7. Review of Request for Access and Records. 2.7.1. Review of Access Request and Action to Contents. The Access and Privacy Coordinator, or his or her delegate, shall review the request for access to records within five (5) days of receipt by Travel Manitoba, and shall: (i) transfer same to another public body where appropriate; (ii) assess whether the request relates to personal health information under the custody or control of Travel Manitoba, and administer and respond to such request; or (iii) identify same for response under paragraph 3.4 and action appropriate Travel Manitoba staff to assemble subject records for review by the Access and Privacy Coordinator and appropriate Travel Manitoba staff forthwith on a deadline to be reasonably set by the Access and Privacy Coordinator to facilitate response within the response deadline. 2.7.2. Review of Records. The Travel Manitoba Access and Privacy Coordinator, or his or her delegate, will review the assembled records. Care shall be taken to: (a) identify any personal information of the applicant and whether the records contain any personal information of any third party; (b) identify any personal health information, which shall be handled in accordance with the personal health information protocols set out in Part 4 paragraph 4 under this Privacy Policy;
(c) whether any information that should not or may not be disclosable at law can reasonably be severed from the subject records; and (d) if information requested is in electronic form in the custody or under the control of Travel Manitoba, then having determined that it should produce the record, Travel Manitoba shall produce it for the applicant if: (i) it can be produced using the normal computer hardware and software and technical expertise of Travel Manitoba, and (ii) producing it would not interfere unreasonably with Travel Manitoba's operations. 2.7.3. Mandatory and Discretionary Exceptions to Disclosure to be Considered. The Access and Privacy Coordinator shall, in determining what if any records and information within those records may be disclosed as part of an access request, consider the mandatory and discretionary exceptions set out at law. 2.7.4. Refusal to Confirm or Deny Existence of a Record. Pursuant to applicable laws, Travel Manitoba is required in certain circumstances to refuse to confirm or deny the existence of a record. Where requested records are of a sensitive nature, same shall be referred to the Access and Privacy Coordinator for consideration. 2.7.5. Notice to Third Parties – Personal Information to be Disclosed. Where Travel Manitoba is considering giving access to a record the disclosure of which might: (a) result in an unreasonable invasion of a third party's privacy at law; or (b) affect a third party's business or proprietary interests, then third party notice may be required. The Access and Privacy Coordinator shall be consulted in respect of any relevant records and notifications within the response window for direction. 3. Responses to Access Requests (Records Not Containing Personal Health Information). 3.1. Content of Response. In responding to an access request, the Access and Privacy Coordinator or his/her/their designates shall inform the applicant as follows: (i) whether the access to the record or part of the record requested is granted or refused; (ii) if granted (in whole or in part), where, when and how access will be given; and (iii) if access to the record or part of the record is refused: i. in the cases of record that do not exist or cannot be located, that the record does not exist or cannot be located; ii. the title and contact information of the Access and Privacy Coordinator of Travel Manitoba who can answer questions on behalf of Travel Manitoba about the refusal, and iii. that the applicant may make a complaint to the Manitoba Ombudsman about the refusal.
3.2. Time Limit for Response and Extensions of Deadlines to Respond. 3.2.1. Forty-Five (45) Days Unless Extended Or Third Party Notice Required. Travel Manitoba shall respond to requests for access to records under the custody and/or control of Travel Manitoba as soon as reasonably possible and in any event within forty-five (45) days of receipt of same, unless: (i) Travel Manitoba transfers the request to another public body within ten (10) days after it was received where: (a) the record was produced by or for the other public body, (b) the other public body was the first to obtain the record, or (c) the record is in the custody or control of the other public body, and in such circumstances, the Travel Manitoba shall notify the applicant of the transfer in writing as soon as possible of the transfer; or (ii) Travel Manitoba reasonably determines that: (a) responding within the time period is unreasonable because of the large number or records requested or that must be searched, or the number of requests made by the applicant or by two or more applicants who are associated, or (b) time is needed to consult a third party or another public body, or to obtain legal advice before deciding whether or not to grant an access request, (c) a third party makes a complaint, (d) the applicant consents to the extension, or (f) there are exception circumstances that warrant the extension. In the case of an extension due to this paragraph 3.2.1.(ii), Travel Manitoba shall notify the applicant setting out (a) the reason for the extension, (b) when the response can be expected, and (c) that the applicant can make a complaint to the Ombudsman of Manitoba in respect of the extension; or (iii) Where Travel Manitoba is considering giving access to a record which might: (a) unreasonably result in invasion of a third party's privacy; or (b) affect a third party's business or proprietary interests, such response and applicable records shall follow legislated requirements for notifications set out under applicable laws to ensure legislative compliance. 3.2.2. Travel Manitoba In Receipt of Transfer Request. If Travel Manitoba is the recipient of a access request from a third party public body, and if upon review of that request in the normal course, Travel Manitoba determines that is must respond to same, then Travel Manitoba shall make every reasonable effort to respond to the request within forty-five (45) days after receiving it unless that time limit is extended under the same grounds set forth in paragraph 3.2.1. of this Policy above. Where Travel Manitoba is not the appropriate party to receive and respond to such an access request, it shall respond forthwith in writing to the sending public body and detail the grounds on which Travel Manitoba is not the proper respondent.
3.3. Failure to Respond Deemed Refusal. A failure to respond by Travel Manitoba within the designated time period shall be deemed to be a refusal to provide the requested record(s). 3.4. Fees. 3.4.1. May Require a Fee. In accordance with fees set by Travel Manitoba from time to time and in compliance with applicable laws, Travel Manitoba may require an applicant to pay fees in respect of access to or receipt of copies of requested records. Travel Manitoba may also, in its discretion, determine to waive the payment of all or part of any fee. 3.4.2. Estimate of Fee To Be Provided. Where a fee will be charged by Travel Manitoba in respect of a request for records, Travel Manitoba shall give the applicant an estimate of the total fee before providing the service. The applicant has thirty (30) days from the date that the estimate was given to accept or modify the request in order to change the amount of the fees, after which the application will be considered to be abandoned. 3.4.3. Estimate Response Affects Access Response Deadline. When an estimate is given to an applicant under this paragraph 3.4, the time to respond to an access request under paragraph 3.2.1. is suspended from the date of the estimate until the applicant notifies Travel Manitoba that he/she/they wish to proceed with the application. 3.5 How Access Will Be Given. Where Travel Manitoba has made a determination that access to a record will be granted to the applicant, it may do so by: (a) giving a copy of the record where the applicant has asked for a copy and the record can reasonably be reproduced; or (b) if the applicant has asked to examine a record or has asked for a copy of the record that cannot reasonably be reproduced, by permitting the applicant to examine the record or a part of it or by giving him/her/them access in accordance with applicable laws. In granting access to a record, Travel Manitoba may also give the applicant any additional information that Travel Manitoba believes may be necessary to explain the provided records. 4. For Records Containing Personal Health Information. 4.1. This Part 4, paragraph 4 applies to records under the custody or control of Travel Manitoba that contain personal health information. 4.2. Right of Access and Reasons for Refusal 4.2.1. Right to Examine and Receive a Copy. Subject to this paragraph 4.2 of this Part 4 below, and to the limited extent that Travel Manitoba may have personal health
information under its custody or control, the subject individual has a right on request to examine and receive a copy of his or her personal health information records. 4.2.2. Right to Ignore Request. Travel Manitoba may disregard a request to examine or receive a copy of personal health information where it reasonably believes that: (a) the request is for information already provided to the individual who made the request; or (b) the request amounts to an abuse of the right to make a request because it is unduly repetitive or systematic, or otherwise made in bad faith. Should Travel Manitoba determine to ignore any such request, it shall notify the applicant in writing of its decision and the reasons for it, and of the individual's right to make a complaint to the Manitoba Ombudsman concerning that decision. 4.2.3. Refusal to Allow Examination or a Copy. Travel Manitoba may refuse to permit an individual to examine or copy his/her/their personal health information, where permitted or required under applicable laws. Where the personal health information sought contains sensitive information, direction of the Access and Privacy Coordinator shall be sought prior to disclosure and to determine whether any release of records should be refused. 4.2.4. Sever Where Possible. Where Travel Manitoba refuses to permit personal health information to be examined or copied above, to the extent possible Travel Manitoba shall sever the personal health information that cannot be examined or copied, and permit the individual to examine and receive a copy of the remainder of the information. PART 5 – REQUESTS FOR CORRECTION 1. Correction. 1.1 Right to Request Correction. Should an individual believe that his/her/their personal information held in a record under the custody and/or control of Travel Manitoba contains an error or omission, he/she/they may request in writing that Travel Manitoba correct the record. Where records to be corrected contain personal health information, Part 5, Paragraph 2 shall be followed. 1.2. Investigate Correction Request and Response. 1.2.1. Investigate. Travel Manitoba shall review and, as necessary, investigate the correction request. 1.2.2. Response. Except in the case of circumstances set out in Part 5 paragraph 1.3, Travel Manitoba shall within thirty (30) days of receiving a request for correction (or the extended deadline pursuant to Part 5, paragraph 1.5 below), shall: (a) make the requested correction, notify the individual in writing of the correction, and update the individual's record to document the correction request and correction in writing;
or (b) notify the applicant in writing of the following: (i) Travel Manitoba's refusal to correct the record; (ii) the reason for the refusal; (iii) the applicant's right to add a statement of disagreement to the record; (iv) the individual's right to make a complaint about this refusal to the Manitoba Ombudsman. 1.2.3. Statement of Disagreement. Where Travel Manitoba refuses to make a correction requested under this Part 5 paragraph 1.2 (and except in the case of paragraph 1.3 of this Part 5 below), Travel Manitoba shall: (a) permit the individual to file a concise statement of disagreement stating the correction requested and the reason for the correction; and (b) add the statement of disagreement to the record in such a manner that it will be read with and form part of the record or be adequately cross-referenced to it. 1.2.4. Notice to Others. Where Travel Manitoba corrects a record, or adds a statement of disagreement to a record, Travel Manitoba shall notify any other public body or third party to whom the information has been disclosed during the year before the correction was requested that the correction has been made or a statement of disagreement has been added. 1.2.5. Where Travel Manitoba Receives Notification of Correction or Statement of Disagreement. Upon being notified of a correction or statement of disagreement by another public body, Travel Manitoba will note same on the subject file and alternatively make the correction or add the statement of disagreement to any record of that information under Travel Manitoba's custody or control. 1.3 Request May Be Ignored In Limited Cases. Travel Manitoba may ignore the correction request under paragraph 1.1 of this Part 5 where Travel Manitoba reasonably believes that the request: (a) is trivial, frivolous or vexatious; (b) is for information already provided to the applicant; (c) amounts to an abuse of the right to make a request because it is: (i) unduly repetitive or systematic; (ii) excessively broad or incomprehensible; or (iii) not made in good faith; or
(d) responding to the request would unreasonably interfere with Travel Manitoba's operations. In making the above noted determination, Travel Manitoba shall take into account both the number of requests made by the same applicant, and whether the request is reasonably related to requests that have been made by two or more applicants who are associated. 1.4 Notice Where Request Will Be Ignored. In the circumstances where Travel Manitoba will ignore the correction request as per Part 5, paragraph 1.3 of this Privacy Policy, Travel Manitoba shall issue a response as follows: (a) that the request is refused and the reason why; (b) the reasons for Travel Manitoba's decision; and (c) that the applicant may make a complaint to the Manitoba Ombudsman about the refusal. 1.5. Extension Request for Correction Response. The thirty (30) day response deadline for requests for correction may be extended as follows: (a) where the initial response deadline is unreasonable because of: (i) the large number of records requested or that must be searched, or (ii) the number of requests made by the applicant or by two or more applicants who are associated; (b) time is needed to consult with a third party or another public body, or to obtain legal advice, before deciding whether or not to grant access to a record; (c) the applicant consents to the extension; or (d) exceptional circumstances warrant the extension. Where the thirty (30) day deadline is extended, Travel Manitoba shall send a written notice to the applicant setting out: (a) the reasons for the extension; (b) when a response can be expected; and (c) that the applicant may make a complaint to the Manitoba Ombudsman about the extension. 2.0 Correction of Personal Health Information in Travel Manitoba Records 2.1. Review Request for Correction. Travel Manitoba shall review the request for correction to personal health information. 2.2. Response Deadline and Response Options. As promptly as required in the circumstances, but no later than thirty (30) days after receiving a request, Travel Manitoba shall do one of the following:
(a) make the requested correction by adding the correcting information to the record of the personal health information in a manner that forms part of the record or be adequately cross-referenced to it; (b) inform the individual if the personal health information no longer exists or cannot be found; (c) inform the individual if Travel Manitoba does not maintain the personal health information, and whether another trustee (specifying name and address) maintains same; (d) if the request to correct is refused, inform the individual of the reasons for the refusal, and the individual's right to add a statement of disagreement to the record consistent with those rights provided generally under this Privacy Policy. 2.3. Notify of Right to Make a Complaint. The response to the subject individual shall also include, in the case of paragraph 2.2(b) or 2.2(d) above, that the individual may make a complaint to the Manitoba Ombudsman about Travel Manitoba's response under this Part 5, paragraph 2.0. 2.4. Notify Others of Correction/Statement of Disagreement. Where Travel Manitoba makes a correction or where a statement of disagreement is added, Travel Manitoba shall when practicable notify any other trustee or person to whom the personal health information has been disclosed during the year before the correction was requested about the correction or add the statement of disagreement to any record of personal health information that Travel Manitoba maintains. 2.5. No Fees. Travel Manitoba shall not charge a fee in connection with a request for correction made under this Part 5, paragraph 2.0.
PART 6 – INQUIRIES AND COMPLAINTS 1.0 Right to Inquire or Complain. Should you have any questions or concerns in respect of Travel Manitoba's privacy practices, please direct same to our Access and Privacy Coordinator at fippaTMB@travelmanitoba.com
We reserve the right to change and update our Privacy Policy on notice, and the last updated date shall be set out at the opening of this Privacy Policy.
PART 7 - SCHEDULES
Schedule "A" CONFIDENTIALITY AND PRIVACY AGREEMENT I understand that as an employee, contractor or otherwise working on behalf of Travel Manitoba, all personal information and personal health information I may have access to is private and confidential. I understand that: 1. "Personal information" means information about an identifiable individual. Personal information includes, for example, an individual's name, address, telephone number, email address, and all manner of information concerning the subject individual but does not include business contact information when used for that purpose. 2. "Personal health information" means information concerning the personal health, health care history or other health-related information concerning an identifiable individual. 3. I acknowledge and agree that Travel Manitoba is bound by applicable privacy laws, including without limitation, The Personal Health Information Act, the Freedom of Information and Protection of Privacy Act and The Personal Information Protection and Electronic Documents Act (the “Acts”) and any applicable regulations (the “Regulations”), all as amended at law from time to time, and that all personal information and personal health information must be handled in accordance with those requirements and the Travel Manitoba Privacy Policy. As an employee, contractor or otherwise working on behalf of Travel Manitoba, I pledge and undertake to comply with the Travel Manitoba Privacy Policy and with the policies and procedures of Travel Manitoba respecting the collection, use, disclosure, protection, retention and destruction of any personal information and personal health information that I may have access to during the course of my employment, contracted activities, duties or otherwise. 4. The Travel Manitoba Privacy Policy, the Website/App Privacy Code, Records Retention Schedules, and such additional documents as directed by Travel Manitoba from time to time form, collectively, the Travel Manitoba Privacy Policy. I agree not to collect, use, disclose or destroy personal information or personal health information except in accordance with the Acts, Regulations and the Travel Manitoba Privacy Policy, as well as any directives issued by Travel Manitoba. I acknowledge that failure to comply with the Travel Manitoba Privacy Policy, the Acts or Regulations, may result in disciplinary action up to and including termination and may also result in me being reported to my professional regulatory body (if applicable) and prosecution under applicable laws.
Name (please print) Signature
Date
Schedule "B" ACCESS REQUEST FORM Applications for access can be requested using the Province of Manitoba “Application for Access” form found online at: https://www.gov.mb.ca/asset_library/en/fippa/fippa_appform.pdf Applications shall be submitted to: Travel Manitoba Access and Privacy Coordinator 21 Forks Market Road Winnipeg, MB R3B 4T7 fippaTMB@travelmanitoba.com