Privacy

If a privacy complaint or (suspected) breach has occurred, the following steps must be followed:

Step 1

Report the suspected breach

Any team member who becomes aware of a possible breach of privacy involving Personal Information in the custody or control of the Company will immediately inform their supervisor or manager or the Privacy Officer.  When notified of a possible privacy breach, supervisors and managers are responsible for notifying the Privacy Officer as soon as practicable, via email at: [email protected].

The Privacy Officer will contact any other departments or individuals who have a need to know. Preliminary questions that a team member should be prepared to answer when reporting a breach or suspected breach are:

• When was the incident discovered?
• What was the date of the incident?
• What was the location of the incident?
• How was the incident discovered?
• What happened?
• Has the breach been contained?
• How many individuals may be affected?

The Privacy Officer will initiate an investigation into the reported possible breach to be undertaken and will direct and monitor the actions in steps 2 – 5 below to contain, evaluate, respond to and remediate any breach that has occurred.

Note: BCLC Standards requirement: Service Providers shall notify BCLC Investigations Leadership by email at [email protected] and the Service Provider Compliance Officer immediately and without delay upon discovery of any actual or suspected unauthorized collection, use, access, disclosure, storage, or disposal of Player Personal Information.

Step 2

Contain the Breach

Take steps, as soon as possible, to contain the breach by, for example, stopping the unauthorized practice, recovering the records, disconnecting or shutting down the system that was breached, revoking or changing computer access codes and correcting weaknesses in security.

If the breach contains a public bodies’ Personal Information, the Company will comply with any directions that the public body delivers in regard to managing or containing the breach.

Step 3

Evaluate the Risks

Assess the risks associated with the breach. This step includes assessing:

1. The number of individuals affected by the breach;
2. The identity of persons affected by the breach (e.g., team members, guests, members of the public);
3. The type, amount and sensitivity of the information involved;
4. The probability that the Personal Information has been, is being or will be misused;
5. The type(s) of potential harm to individuals (e.g., identity theft/fraud, security risks, financial loss, humiliation or damage to reputation);
6. Potential harm to the Company (e.g., risks to reputation, loss of assets, exposure to legal proceedings, fines or other regulatory penalties);
7. The cause of the breach (e.g., whether the breach was intentional/malicious or accidental), including the known or probable perpetrators;
8. Security measures that were in place to protect the information (e.g., whether a lost device was password protected and/or whether accessed information was encrypted);
9. Whether the breach resulted from an isolated incident or a systemic issue; and
10. The extent of the breach, including the number of likely recipients and whether there is a risk of on- going breaches or further exposure of the information.

Step 4

Notify if Necessary or Prudent

If a breach occurs, the Privacy Officer will notify or cause authorized agents to notify relevant Crown Corporations or regulatory bodies. The Privacy Officer will work with these organizations in determining if notification to affected individuals is necessary or required. Team members of the Company will promptly cooperate and work with these organizations in every reasonable way to handle the breach.

The Privacy Officer will assess whether mandatory notification is required pursuant to any other contracts to which the Company is a party and whether notification is required under any Applicable Privacy Laws (e.g., notification of the Office of the Privacy Commissioner of Canada, affected individuals, and other organizations and government institutions pursuant to PIPEDA).

The Privacy Officer will also determine whether notification is necessary or prudent regardless of statutory requirements. For example, the Privacy Officer may contact:

1. Legal counsel to assist with breach response and evaluation of legal obligations;
2. Law enforcement authorities, if the breach appears to be caused by illegal action or could result in the commission of a crime;
3. The Company’s insurer, if the breach is covered by an insurance Policy;
4. Affected individuals, if they are at risk of harm;
5. Credit monitoring organizations, where there is a risk of identity theft; or
6. Relevant privacy commissioners even if not required by statute.

The Privacy Officer will take reasonable steps to ensure that the manner, content and timing of notifications does not negatively impact any on-going investigation or unintentionally lead to further breach of Personal Information and will also take in to account any statutorily mandated timing and content requirements applicable to notification. If the information contains the public bodies’ Personal Information, they will provide guidance and make decisions on appropriate notifications to the privacy commissioner and/or affected parties.

Step 5

Remediation

Analyze the cause of the breach. If necessary, this will include a security audit of physical, organizational and technological measures. As a result of this evaluation, if appropriate, the Privacy Officer will assist the responsible department(s) to put into effect additional safeguards against further breach and will review relevant policies, procedures and training programs to determine if amendments should be made based upon the circumstances giving rise to the breach.

Team members responsible for the breach, either through intentional action, negligence or non- compliance with the Company’s Privacy Policy will be subject to disciplinary action up to and including termination of employment or relationship with the Company.