Access and Privacy Code

Procedures and Practices (PDF)
RECO Request Form (PDF)

Purpose

Pursuant to the Administrative Agreement, this Code establishes policy and practices regarding Records in the custody and control of RECO, including that:

• Records should be available to the public;
• Access to Records collected or maintained by RECO in the administration of its statutory mandate, including Personal Information, in accordance with the provisions of the Trust in Real Estate Services Act, 2002 (TRESA), the Administrative Agreement and the SCSAA;
• The protection of Personal Information, including Personal Information of RECO employees;
• The collection, use and disclosure of personal and other information by RECO in the administration of its statutory mandate and in accordance with the provisions of TRESA, the Administrative Agreement and the SCSAA; and   
• Effective and timely procedural remedies concerning the handling of Records collected by RECO in the administration of its statutory mandate.

Application – Regulatory Activity

This Code applies to Records, including of Personal Information, which is collected, used or disclosed by RECO in the course of RECO’s administration of TRESA.

Definitions

Access: means access by an individual or an organization to a record of information in the custody of RECO and under the control of RECO.

Act or TRESA: means the Trust in Real Estate Services Act 2002 (TRESA) and the regulations thereunder, as amended from time to time.

Administrative Agreement: means the agreement between the Queen in the Right of Ontario as represented by the Minister of Government and Consumer Services and RECO, as amended from time to time.

Administration of the Act: means the exercise of powers and duties assigned under the Act and/or SCSAA, and includes any activity related to an obligation under the Administrative Agreement.

Bulk Data: means Records requested in bulk or selective form that do not contain Personal Information and may have commercial value, subject to the provisions of TRESA.

Code: means this Access and Privacy Code. 

Control: means the power or authority to make a decision about the use or disclosure of a Record.

Custody (of a record): means the keeping, care, watch, preservation or security of the Record for a legitimate business purpose.

Enforcement Activity: Includes inspections, investigation or law enforcement proceedings of RECO in accordance with TRESA, or other provincial and federal enforcement bodies, whether or not any of the forgoing is still ongoing.

Enforcement or Enforcement Body: means:  

1. Policing;
2. investigations or inspections that lead or could lead to proceedings in a court or tribunal; or
3. c) the conduct of proceedings referred to in clause (b).

Personal Information: means a Record of information about an identifiable individual, or by which an identifiable individual can be deduced, whatever the format.

Public Information: means information, other than Personal Information, that RECO determines is necessary to make available to the public in order to carry out its administration of TRESA.

Record: means any record or information, however recorded, in the custody and control of RECO in furtherance to the administration of TRESA.

Senior Management Team: means the members of the executive management team established for the purpose of administering and leading the organization.

RECO: means the Real Estate Council of Ontario, a delegated authority to administer TRESA pursuant to section 3 of the SCSAA.

SCSAA: means the Safety and Consumer Statutes Administration Act, S.O.   1996 Chapter 19 as amended from time to time.

1. Accountability

1.1     RECO is responsible for all Records in its custody and under its control. RECO has designated a Chief Privacy Officer to be accountable for compliance with this Code. The contact information for RECO’s Chief Privacy Officer is as follows:

George Drametu, Chief Privacy Officer
Phone: (416) 207-4848
Fax: (416) 207-3106
Toll Free: 1-800-245-6910
E-mail: PrivacyOffice@RECO.on.ca

3300 Bloor Street West, Suite 1400      
West Tower
Toronto, Ontario
M8X 2X2

1.2     The ongoing collection and processing of information may be the responsibility of individuals within or employed by RECO.  

1.3     RECO shall take reasonable steps to ensure that the Records in its custody and under its control are accurate, complete and as up-to-date as is necessary for the purposes for which they were collected.

1.4     Although RECO takes reasonable steps to ensure the accuracy of the Records provided under this Code, it does not warrant or otherwise guarantee that the information is complete, accurate and/or up-to-date.

2. Access to Records

2.1     Subject to the exceptions set out in section 3 of this Code, every person has a right of access to the Records in the custody and control of RECO.

2.2     Subject to section 3.4 of this Code, where information that is exempted from an access request can be reasonably severed from that part of a Record to which the requester can be given access, RECO shall sever the exempted information, and provide the requester with access to the remaining part of the Record.

Obligation to Disclose

2.3     Despite any provision of this Code, RECO shall, as soon as practicable:

1. disclose any Record to the public or persons affected if RECO has reasonable and probable grounds to believe that it is in the public interest to do so and that the Record reveals a grave environmental, health or safety hazard to the public; or
2. disclose any Record as is required by law.

Notice to Affected Person

2.4     Before disclosing a Record which contains Personal Information under subsection 2.3(a) of this Code, RECO shall cause notice to be given to any person to whom the information in the Record relates, if it is practicable to do so.  

2.5     Any notice given under this section must be in writing and include a statement that if a person makes representations forthwith to RECO as to why the Record, or part thereof, should not be disclosed, those representations will be considered by RECO.

Access Requirements and Procedure – Public Information

2.6     RECO shall ensure that the public has ready access to Public Information. The information shall be available in various mediums for review, consistent with the provisions of TRESA, and where practicable, be posted on RECO’s website. RECO’s information materials, including its website, shall provide instructions on how the public can contact RECO to obtain access to public information.    

2.7     RECO shall support access to information by disseminating Public Information as is required and relevant to its administration of TRESA.  

Access Requirements and Procedure – Personal Information

2.8     Within a reasonable period of time of receipt of a written request, having regard to the nature of the Personal Information requested, RECO shall advise an individual regarding the existence, use and disclosure of his or her Personal Information and, subject to the exceptions set out in section 3 of this Code, provide the individual with access to his or her Personal Information in a generally comprehensible form.

2.9     Requests for access to Personal Information shall be provided in the form established by RECO, and should include sufficient information to allow RECO to identify the requester and his or her Personal Information.

2.10 Where an individual requests access to Personal Information in the custody and control of RECO that pertains to individuals or organizations other than the requester, this is considered a third party request for information.  

2.11 Where a third party request is approved, and before the disclosure of any Personal Information, RECO shall notify the individual in writing that his/her Personal Information is disclosable, and will be given a reasonable period of time to contest to disclosure. In doing so, the individual must provide sufficient written reasons for his/her disclosure objection.

2.12 Where access is refused, RECO shall provide written reasons for the refusal to the requester. The requester may file a complaint with RECO concerning the access refusal, pursuant to section 7 of this Code.

2.13 Before proceeding with any access request, and in accordance with section 8 of this Code, RECO shall provide the requester with the approximate fees payable, if any, of responding to the request, and confirm whether the requester still wishes to proceed with the access request, or whether the request is to be withdrawn.    

2.14 Where third parties have access to Personal Information on an ongoing basis in accordance with section 5.2(b) of this Code, any amendments to such information shall be provided to the third parties.

3. Exceptions to Access

Mandatory Exception

3.1     Subject to sections 3.4 and 3.5 of this Code, RECO shall refuse a person access to a Record where the Record, or part of the Record, would likely reveal Personal Information about another person, unless the other person consents to the access in writing.

Discretionary Exceptions

3.2     Subject to sections 3.4 and 3.5 of this Code, RECO may refuse access to a Record where giving access to the Record or part of the Record:  

1. may violate a legally recognized privilege;
2. may provide access to information that is the substance of deliberations by one or more of the following: RECO’s Board of Directors, Senior Management Team, Committees, including Management Committees, Board Committees, or other like committees established by RECO. The information may include, but is not limited to: agenda, minutes, policy options and analysis, advice from staff or an external consultant, advice to government or a draft of a by-law, resolution or regulations;
3. may provide access to information provided, gathered or generated in the course of a dispute resolution process or the administration of TRESA, including consumer and individual complaints;
4. may derive from or compromise an Enforcement Activity;
5. may contain bulk data, or contains aggregate data or other sensitive aggregate data that may identify a specific person;
6. may reveal confidential commercial, scientific, proprietary, technical, financial or labour relations information, if access to this information may result in undue loss or gain, prejudice a competitive position or interfere with contractual or other negotiations of a third party;
7. may be information provided in response to a request for proposal, request for quotation or other similar purpose where the Record may reasonably reveal commercial, scientific, proprietary, technical, financial or labour relations information, if access to this information may result in undue loss or gain, prejudice a competitive position or interfere with contractual or other negotiations of a third party;
8. may be refused under subsection 14 (1) of the Freedom of Information and Protection of Privacy Act, R.S.O. 1990 Chapter F.31;
9. may not be in the public interest, or could reasonably be expected to threaten the life, health or security of an individual;
10. may reasonably endanger the security of a building, vehicle, or of a system, including IT systems, or procedure established for the protection of a building or information for which protection is reasonably required;
11. may be information compiled by RECO or supplied to RECO for the purposes of risk management or risk informed decision making;
12. may be unreasonably costly to provide and would reasonably unduly impact RECO’s operations, determined by taking into account the nature of the request and volume of documents requested;
13. may be frivolous or vexatious;
14. may be a Record supplied by government, regulatory or Enforcement Body to RECO in confidence; or
15. where access to the information may be inconsistent with s. 44 of the Act or otherwise violates another provision of TRESA.

3.3     Despite sections 3.1 and 3.2 of this Code, RECO may release a Record where not releasing the Record would threaten an individual’s life, health or security, or where not releasing the Record would endanger the security of a building, vehicle, or of a system, including IT systems, or procedure established for the protection of a building or information for which protection is reasonably required.

3.4     Section 2.2 of this Code does not apply where the Record: 

1. is protected by solicitor-client privilege;  
2. was generated in the course of a dispute resolution process; 
3. was collected without knowledge or consent for purposes related to Enforcement Activities as permitted by the exception under section 4.6 of this Code; or  
4. is a report prepared in the course of Enforcement Activities.

3.5     RECO may refuse to confirm or deny the existence of a Record to which subsections 3.2b, 3.2d, 2h, 3.2m or 3.2n of this Code apply.

4. Collection of Personal Information

4.1     Collection of Personal Information shall be limited to that which is necessary for the carrying out of RECO’s administration of TRESA 2002 or a consistent purpose.

4.2     Some of the purposes for which RECO has collected and collects Personal Information include, but are not limited to, the following:

1. to Process applications for registration and registration renewals;
2. to provide RECO’s programs, products and/or services, such as administration of RECO’s insurance program;
3. for administrative, management and business purposes;
4. to process complaints;
5. to conduct Enforcement Activities;
6. to manage, develop and evaluate RECO’s business and operations;
7. to comply with legal and regulatory requirements applicable to RECO; or
8. for any other purpose for which RECO has a person’s consent.

4.3     By providing RECO with Personal Information, an individual consents to its use and disclosure in accordance with this Code and for the purpose of administering TRESA, and other relevant legislation. As well, such consent may be implied through the individual’s conduct with RECO.

4.4     Subject to the exception set out in section 4.6 of the Code, where RECO collects Personal Information, it shall:

1. only collect Personal Information directly from the individual to whom the information relates, unless the individual authorizes another manner of collection; and
2. explain to the individual the purpose for collecting the Personal Information and, at or before the time of collection, obtain his or her consent for its collection, use and disclosure by RECO for that purpose.

4.5     Subject to the exception set out in section 4.6 of this Code, where RECO collects Personal Information, RECO shall document the purpose for which Personal Information is collected.

Exceptions

4.6     Where Personal Information is collected for the purposes of the administration of TRESA, RECO may collect the information without the knowledge or consent of the individual to whom the information relates, and/or communicating the purpose of the collection, if such collection is necessary for the administration of TRESA.

5. Use and Disclosure of Personal Information

5.1     Subject to the exceptions set out under section 5.2 of the Code, RECO shall use or disclose Personal Information only with the prior knowledge and consent of the individual to whom the information relates, and only for the purposes for which it was collected.

Exceptions

5.2     RECO may use or disclose Personal Information without the prior knowledge or consent of the individual, or for purposes other than those for which it was collected, if:  

1. the information is used or disclosed for purposes related to an Enforcement Activity;
2. the information is subject to an agreement RECO has entered into with a third party to manage or use RECO Records on its behalf, if such agreement requires the third party to comply with this Code and have in place security safeguards comparable to those used by RECO;
3. such disclosure is permissible under s.44 of the Act;
4. it is necessary to protect the rights, safety of an individual or a group, or a registrant;
5. the information is for the purpose of complying with a court order, complying with an Act of the Legislature or an Act of Parliament or a treaty, agreement or arrangement thereunder;  
6. it is disclosed for the purpose for which it was obtained, for a consistent purpose, or required by law; or
7. to RECO’s counsel.

Retention and Security of Personal Information

6.1     Having regard to the level of sensitivity of the particular information, RECO shall take all reasonable steps to ensure that Personal Information is kept secure from loss and theft.

6.2     RECO shall, where possible, retain Personal Information for a minimum of one (1) year, and only for as long as necessary to fulfil the purpose for which the information was collected; however, Personal Information that is the subject of an access request shall be retained for as long as necessary to allow the requester to exhaust any recourse under this Code.   

6.3     RECO shall develop procedures and practices to govern the period of time Personal Information is retained, and the methods by which it should be destroyed, erased or made anonymous once no longer required by RECO.   

6.4     RECO shall publicly post on its corporate website, under “Release of Records,” said procedures and practices in the form of a Retention Policy.  

6.5     Ongoing access to Personal Information under the control of RECO shall be restricted to authorized RECO staff. RECO shall adopt security mechanisms to prevent the unauthorized access, disclosure, use, copying or modification of Personal Information under its control.

7. Complaints and Remedies

Complaints About Accuracy & Completeness of Personal Information

7.1     Where an individual disagrees with the accuracy or completeness of his / her Personal Information about him / herself held by RECO, the individual has the right to challenge the accuracy or completeness and have it addressed as follows:

Format for requests  

1. Individuals solely requesting corrections to their Personal Information in order to ensure its accuracy and/or completeness shall send their requests in writing to RECO’s Chief Privacy Officer at the contact information provided in section 1.1 of this Code. The request must include sufficient detail to identify the applicable Personal Information and the correction being sought.
2. Individuals who are requesting corrections must first make an access request in writing to RECO’s Chief Privacy Officer at the contact information provided in section 1.1 of this Code to determine what Personal Information can be released, and which is exempt from release under the criteria set out in this Code. Once this process is complete, RECO can continue processing the correction request.

Review process

1. RECO shall respond in writing to a request for correction(s) or amendment(s) to Personal Information within a reasonable number of days after receiving the request, unless there are special circumstances. RECO will correct or make the appropriate amendments to statements that are inaccurate or incomplete, unless RECO is unable to make the correction, due to circumstances that include, but are not limited to, the following:  

1. the fact that the statement was made, whether it is correct or not, is relevant to the regulatory activities of RECO;
2. RECO determines that it does not have sufficient knowledge, expertise or authority to make the correction;
3. correction or amendment may reasonably interfere with a regulatory process of RECO including, but not limited to, an inquiry, investigation, hearing or other Enforcement Activity;
4. correction or amendment may reasonably interfere with the regulatory or enforcement activities of another statutory regulatory body or a law enforcement agency;
5. correction or amendment may alter an original document that belongs to someone else and will eventually be returned to that person; or
6. correction or amendment is prohibited by a law.

7.2     Where RECO agrees to correct or amend a Record of Personal Information:

1. amendments or corrections to Personal Information received from the individual to whom it relates shall be recorded by RECO as soon as practically possible, and will be made so as not to obliterate the original entry; and
2. RECO will provide written notice to every third party to whom the original Record was provided within the previous twelve (12) months, unless to do so is impractical (e.g., website access) or would reasonably interfere with the regulatory activities of RECO.

7.3     If an individual’s request for a correction or amendment is refused, the reasons for such refusal shall be provided in writing to the individual to whom the information pertains, and RECO will, if requested, file with the Record a brief statement of disagreement provided by the individual, unless to do so is impractical or would reasonably interfere with the regulatory activities of RECO.

Other Complaints

7.4     Where an individual has a complaint regarding:

1. RECO’s handling of the release of Records to a requestor;
2. RECO’s refusal to release Records to a requester; or
3. any other matter within the scope of this Code, that individual has the right to have their concern addressed.

7.5     RECO will implement, and make publicly available, practices and procedures for the handling complaints referred to in section 7.4; practices and procedures which will include that:

1. individuals are to send their complaints, in writing, to RECO’s Chief Privacy Officer at the contact information provided in section 1.1 of this Code;
2. RECO shall respond to any such complain in writing within a reasonable number of days after receiving the request, unless special circumstances exist; and
3. if a complaint is found to be justified, RECO shall take appropriate measures to rectify the problem, including where necessary, amending its procedures and practices.

8. Fees

8.1     Fees payable for access to Records will be in accordance with RECO’s fee policies which will be made publicly available.

8.2     Any fee estimate for the production of the Records exceeding $100.00 will require the Requester to provide a 25% deposit.

9. Administration

9.1     RECO shall implement policies and practices required to give effect to this Code, including those relating to:

1. the procedure for receiving and responding to requests, complaints or injuries, and the form requests and complaints should take;
2. advising Board members, management and staff about the Code, and providing appropriate training to ensure compliance with the Code’s provisions; and
3. the development of brochures or other documentation describing this policy and its related procedures and practices.

10. Paramountcy

10.1     In the event that this Code conflicts with any provision of TRESA, or any other applicable law, TRESA or any other applicable law shall prevail.

Effective Date and Review

11.1     This Code comes into effect on January 1, 2017.  

11.2     RECO shall initiate from time to time a review of this Code and all related policies and practices. If changes are made to this Code, a revised version of the Code will be posted on RECO’s website at www.reco.on.ca.