Privacy Act Requests
PSP Investments is subject to the Privacy Act.
Please note that PSP Investments is operating in a hybrid workforce model. As a result, there may be a delay in receiving Privacy Act requests submitted by mail. In order for us to address your request as quickly as possible, we would recommend that you submit all Privacy Act requests through the ATIP Online Request Service website using this link. Thank you in advance for your patience and collaboration.
You can make a request under the Privacy Act through the ATIP Online Request Service website using this link or by sending your completed personal information request form to:
Access to Information and Privacy Coordinator
1250 René-Lévesque Boulevard West
Canada H3B 5E9
PSP Investments is subject to the European Union General Data Protection Regulation (the “GDPR”) and the United Kingdom General Data Protection Regulation (the “UK GDPR”). To exercise any of your rights under the GDPR or the UK GDPR, please complete the form below or contact us at the following coordinates:
Access to Information and Privacy Coordinator
European Union residents may also contact our EU GDPR Representative to exercise their rights under the GDPR:
Bredin Prat SAS
Attn: PSP Investments EU GDPR Representative
53 Quai d’Orsay, Paris, 75007 France
United Kingdom residents may also contact our UK entity to exercise their rights under the UK GDPR and UK Data Protection Act:
PSP Investments Holding Europe Ltd
10 Bressenden Place, 8th floor, London, United Kingdom, SW1E 5DH
For California Residents Only
Please note that PSP Investments does not sell personal information. However, please click below should you wish to formally exercise your right to opt-out:
Part I: Purpose
The Public Sector Pension Investment Board and its wholly-owned subsidiaries operating its offices in Canada ( in Montreal and Ottawa), the United Sates (in New York) and the United Kingdom (in London) (collectively “PSP Investments”) are committed to respecting your privacy. The purpose of this Privacy Notice is to outline the policies, procedures and measures PSP Investments takes with respect to the collection, use, disclosure, retention, protection and processing of personal information in order to comply with its obligations under the federal Privacy Act (Canada), the Privacy Regulations (Canada), and applicable policies, directives and guidelines of the Treasury Board of Canada Secretariat (“Treasury Board”) issued pursuant to its mandate under the Privacy Act (collectively the “Canadian Laws”), and other applicable privacy legislation (including but not limited to the General Data Protection Regulation (the “GDPR”), the UK Data Protection Act 2018 ( the “UK DPA”), and the California Consumer Privacy Act (the “CCPA”).
This Privacy Notice provides information on PSP Investments’ privacy practices for individuals that visit our Website, individuals with whom we communicate, prospective employees, individuals on whom due diligence is conducted in the context of our investment activities, individuals for whom an external identity is created in order to access PSP platforms and, prospective/actual unincorporated contractors.
For the purposes of this Privacy Notice, “Personal Information” means information about an identifiable individual that is recorded in any form. Under the Canadian Laws, there are slight differences in the definition of personal information. For more information, please see Part IV: Definitions.
Part II: Privacy Principles
1. Collection of Personal Information
a. PSP Investments shall not collect personal information unless it relates directly to an activity of PSP Investments within mandate under the Public Sector Pension Investment Board Act and other applicable legislation. Personal information collected by PSP Investments shall be limited to what is necessary in order to carry out its mandate.
b. Subject to limited exceptions under the Privacy Act and other applicable legislation, PSP Investments shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom the information relates, except where the individual otherwise authorizes, or where the information is permitted to be disclosed to PSP Investments by another government institution under the Canadian Laws or other applicable legislation.
c. PSP Investments shall inform any individual from whom it collects personal information of the following:
- the purpose for which the information is being collected;
- the authority for the collection, including whether response is voluntary or is required by law;
- any uses or disclosures to be made of the information;
- of the possible legal or administrative consequences of refusing to provide the information; and
- the rights that the individual has with regards to personal information PSP holds and that relates to her or him.
d. PSP Investments may collect personal information from an individual in the following circumstances:
- When an individual visits PSP Investments’ website. Please see the section below title “Privacy and the Internet” for more details about the Website’s collection, use and disclosure of personal information;
- In connection with meetings, conferences or other activities offered by PSP. In the course of these activities, PSP Investments may collect personal information such as business contact information for the purposes of administering the activities. In addition, PSP Investments may collect audio and video recordings for the purposes of recording meeting, training or conference sessions for use within the organization;
- PSP Investments may collect personal information such as screenshots, screen recordings or other personal information since all electronic communications to or from PSP Investments’ domain are subject to monitoring for security and compliance purposes.
- In connection with the creation of an external identity in order to access PSP Investments’ systems, PSP Investments may collect the full name, email address and logs for the purposes of creating and administering external access to PSP systems;
- In connection with unincorporated contractors. PSP may collect personal information such as their tax number for tax payment, remittance and compliance purposes;
- In limited circumstances, PSP Investments may conduct reputational due diligence on individuals in the context of its investments activities using publicly available information or databases without informing the individual beforehand or securing the individual’s consent. In those limited circumstances, informing or obtaining the consent from the specific individual would defeat the purpose or be prejudicial to the use for which information is being collected and/or would not be possible or appropriate given the particular circumstances of the potential transaction or business relationship (for instance, public merger and acquisition transactions, minority or passive investments, credit investments, highly competitive private transactions conducted by auction or similar circumstances).
- When an individual provides personal information during their communications with PSP Investments. For more details, please see the section below titled “Privacy and the Internet”.
2. Retention and Disposal of Personal Information
a. PSP Investments has a Document Management Procedure, which includes a Document Retention Schedule (“the Schedule”). The Schedule sets out retention periods for the various categories of personal information PSP Investments holds. The Schedule is reviewed and updated periodically and is subject to any legal obligations to retain certain information.
b. As a general rule, personal information that has been used by PSP Investments for an administrative purpose shall be retained for at least two years following the last time the information was used for such purpose, unless the individual consents to its disposal.
c. Personal information collected in connection with administrating external identities is retained for three years after it is no longer necessary, subject to any legal obligations to retain this information.
d. Where a request for access to personal information has been received, the personal information subject to such request shall be retained until the requesting individual has had the opportunity to exercise all his or her rights under the Privacy Act, the GDPR, the UK DPA, the CCPA, the Access to Information Act or any other applicable legislation with respect to such personal information.
e. PSP Investments shall dispose of personal information under its control in accordance with the Canadian Laws, the GDPR, the UK DPA, the CCPA and any other legislation applicable to the disposal of that information. As a Canadian federal crown corporation, PSP Investments will also consider the provisions of the Library and Archives of Canada Act when disposing of records containing personal information.
3. Accuracy of Personal Information
PSP Investments shall take all reasonable steps to ensure that personal information it uses for an administrative or operational purpose is as accurate, up-to-date and complete as possible.
Use and Disclosure of Personal Information
a. PSP Investments relies on consent of the individual to whom the personal information relates (or for EU or UK residents, on one of the legal bases), to use and process personal information under its control, except when:
- using it for the original purpose for which the information was collected or compiled by PSP Investments;
- for a use consistent with that purpose;
- for a purpose for which the information may be disclosed in accordance with Section 8(2) of the Privacy Act - This restriction does not apply to disclosures to federal investigative bodies for the purpose of law enforcement or investigations under Section 8(2)(e) of the Privacy Act; or
- for a purpose for which it may be used or processed in accordance with the GPDR, UK DPA or the CCPA, as applicable, including for legitimate interests.
b. PSP Investments shall not, without the consent of the individual to whom the personal information relates, disclose personal information of Canadian citizens or residents under its control except for the purpose for which the information was obtained or compiled by PSP Investments or for a use consistent with that purpose or otherwise for a purpose enumerated and permitted under the Privacy Act.
4. International Data Transfers (applicable to EU Residents)
- PSP Investments may transfer data collected from individuals residing in the European Union or the United Kingdom to third party processors located in countries outside the European Economic Area (EEA) or the United Kingdom. PSP Investments will comply with the GDPR and the UK DPA in respect of any such transfers by ensuring proper transfer mechanisms are in place beforehand and documenting them.
5. Security and Protection of Personal Information
PSP Investments shall protect personal information in its custody or control using physical, organizational and technical security safeguards appropriate to the sensitivity of the information. The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. More sensitive personal information shall be safeguarded by a higher level of protection.
6. Personal Information Rights
For Canadian residents:
Subject to and in accordance with the Canadian Laws, PSP Investments shall, on request by an individual who is a permanent resident of Canada, a Canadian citizen or in Canada at the time of the request, provide the following rights: (1) access any personal information about that individual contained in a personal information bank; and (2)access any other personal information under its control with respect to which an individual is able to provide sufficiently specific information on the location of the information so as to render it reasonably retrievable by PSP Investments and (3) correct the personal information where the individual believes there is an error or omission in the information. PSP Investments will respect the privacy of requesters and will limit, on a need-to-know basis, the disclosure of information that could directly or indirectly lead to the identification of a requester, unless the requester consents to such disclosure.
a. Access Requests: Formal requests for access to personal information must be made through the ATIP Online Request Service website using this link or by writing to the designated officer of PSP Investments or ATIP Coordinator in the form of an Access to Personal Information Request Form prescribed by Treasury Board, and must provide sufficiently specific information about the location of the personal information so as to render it reasonably retrievable by PSP Investments, including but not limited to the relevant personal information banks.
A request that is submitted by telephone or by e-mail shall not be considered to have been submitted pursuant to the terms of the Privacy Act. The designated officer of PSP Investments or ATIP Coordinator will consider whether it is appropriate to process the request on an informal basis, in which case the requester will be offered that option along with an explanation that only formal requests are subject to the provisions of the Privacy Act.
i. PSP Investments will make every reasonable effort to search records under PSP Investments’ control to identify and locate the personal information that is responsive to the request.
ii. PSP Investments shall respond to the individual within thirty days of receipt of a formal request for access, subject to extension of time limits permitted in the Privacy Act, by:
- giving written notice as to whether or not access to the information or a part of the requested information will be given, and
- if access is to be granted, giving the requesting individual access to the information or part of the information, or
- if access is refused, giving written notice that (1) the personal information does not exist, or (2) the specific provision of the Privacy Act on which the refusal was based or the provision on which a refusal could reasonably be expected to be based if the information existed, and shall state that the individual who made the request has the right to make a complaint to the Privacy Commissioner of Canada about the refusal.
iii. Access to personal information in the control of PSP Investments shall be subject to the permissive and mandatory exemptions set out in the Privacy Act. Under the guidance of the ATIP Coordinator, all requested personal information shall be reviewed for the purpose of identifying and severing any portions excluded from the Privacy Act or which must be exempted, and for making a decision concerning disclosure of personal information which may be exempted, and which review shall include all consultations with other government departments as required by Treasury Board policy. Exemptions will be cited on the records unless doing so would reveal the exempted information or cause the injury upon which the exemption is based.
iv. Prior to providing access to personal information, PSP Investments shall require the requesting individual to provide adequate identification. PSP Investments may require the individual to present him/herself in person for identification purposes.
v. If access is to be provided, PSP Investments shall:
- permit the individual to examine the information by providing reasonable facilities for the examination and setting a time for the examination convenient for both PSP Investments and the individual, or
- provide the individual with a copy of the information, and
- if the individual requests that the information be given in a particular official language of Canada and the personal information does not exist in that language and, if necessary, to enable the individual to understand the information, cause the information to be translated or interpreted for the individual;
- if the individual has a sensory disability and requests that access be given in an alternative format, if it is necessary to enable the individual to exercise his or her right of access and if it is reasonable to cause the information to be converted, provide the information in an alternative format acceptable to the individual.
vi. PSP Investments shall consult with the appropriate institutions in all instances involving the application of sections 21, 22 and 23 of the Privacy Act.
PSP Investments shall provide assistance, as required, to individuals in exercising their rights of access under the Privacy Act.
b. Personal Information Corrections and Notations Requests:
i. Every individual who is given access under paragraph (a) above to personal information that has been used, is being used or is available for use for an administrative purpose is entitled to:
- request correction of the personal information where the individual believes there is an error or omission in the information;
- require that a notation be attached to the information reflecting any correction requested but not made, and
- require that any person or body to whom the information has been disclosed for use for an administrative purpose within two years prior to the time a correction is requested or a notation is required: (1) be notified of the correction or notation, and (2) where the disclosure is to another government institution, the institution make the correction or notation on any copy of personal information under its control.
ii. Formal requests for correction of personal information must be made through the ATIP Online Request Service website using this link or in writing to PSP Investments’ ATIP Coordinator, using the Correction Request Form prescribed by Treasury Board (TBS/SCT 350-11).
iii. Where a correction is made by PSP Investments pursuant to the request, within thirty days after receipt of the request, PSP Investments shall:
- notify the individual that the correction has been made;
- notify any person or body to whom the personal information has been disclosed as described in paragraph (a) “Access Requests” above that the correction has been made, and
- if the person or body to whom the personal information has been disclosed as described in paragraph (a) “Access Requests” above is another government institution, notify the appropriate officer of that institution of the requirement to make the correction on every copy of the personal information under the control of the institution.
iv. Where a request for correction is refused by PSP Investments in whole or in part, within thirty days after receipt of the request, PSP Investments shall:
- attach a notation to the personal information reflecting that a correction was requested but was refused in whole or in part;
- notify the individual that (1) the request for correction has been refused in whole or in part and set out the reasons for the refusal, (2) the notation described above has been attached to the personal information, and (3) the individual has the right under the Privacy Act to make a complaint to the Privacy Commissioner of Canada;
- notify any person or body to whom the personal information has been disclosed as described in paragraph (a) “Access Requests” above that the required notation has been attached to the personal information, and notify the appropriate officer of any government institution to whom the personal information has been disclosed as described in (a) “Access Requests” above that the required notation has been attached to the personal information and that the officer is required to attach such a notation to every copy of the personal information under the control of the institution.
For European and United Kingdom Residents:
i. Subject to and in accordance with the GDPR and the UK DPA, PSP Investments shall, on request by an individual residing in the European Union or United Kingdom, provide the following rights:
- The right to access: an individual has the right to request PSP Investments for copies of their personal data.
- The right to rectification: an individual has the right to request that PSP Investments correct any information they believe is inaccurate. An individual also have the right to request PSP Investments to complete the information they believe is incomplete.
- The right to erasure: an individual has the right to request that PSP Investments erase their personal data, under certain conditions.
- The right to restrict processing: an individual has the right to request that PSP Investments restrict the processing of their personal data, under certain conditions.
- The right to object to processing: an individual has the right to object to PSP Investments’ processing of their personal data, under certain conditions.
- The right to data portability: an individual has the right to request that PSP Investments transfer the data that we have collected to another organization, or directly to the individual, under certain conditions.
ii. Formal requests for the above mentioned rights must be made in writing to the designated officer of PSP Investments or ATIP Coordinator in the form located on our website: Privacy rights request form (GDPR) located at the top of this Privacy Notice.
iii. PSP Investments shall respond to the individual within thirty days of receipt of a formal request permitted in the GDPR or the UK DPA, by:
- giving written notice as to whether the right will be granted, and
- if access is to be given, giving the requesting individual access to the information or part of the information, or
- if the right is refused, giving written notice that (1) the reason as to why the right was refused, or (2) the specific provision of the GDPR or the UK DPA on which the refusal was based or the provision on which a refusal could reasonably be expected to be based if the information existed, and shall state that the individual who made the request has the right to make a complaint to the lead authority about the refusal.
For California Residents:
i. Subject to and in accordance with the CCPA, PSP Investments shall, on request by an individual residing in California, provide the following rights:
- Right of Access: right to request that PSP Investments disclose the categories of their personal information collected; the categories of sources from which their personal information is collected; the business or commercial purpose; the categories of third parties with which the business shares their personal information; and the specific pieces of personal information PSP Investments holds about that individual. If a business sells personal information or discloses it for business purposes, consumers have the right to request the categories of information so sold or disclosed;
- Right of Correction/Deletion: right to request PSP Investments to correct or delete personal information that we hold on that individual;
- Right to Opt-Out: right to request PSP Investments not to “sell” personal information to third parties, which can be found at the top of this website page.
ii. PSP Investments shall respond to the individual within forty-five days of receipt of a formal request permitted in the CCPA, by:
- giving written notice as to whether the right will be granted, and
- if access is to be given, giving the requesting individual access to the information or part of the information, or
- if the right is refused, giving written notice that (1) the reason as to why the right was refused, or (2) the specific provision of the CCPA on which the refusal was based or the provision on which a refusal could reasonably be expected to be based if the information existed, and shall state that the individual who made the request has the right to make a complaint to the California Attorney General about the refusal.
Part III: Your Privacy and the Internet
The nature of the Internet is such that Web servers automatically collect certain information about a visit to a website, including the visitor’s Internet Protocol (IP) address. IP addresses are unique numbers assigned by Internet Service Providers (ISP) to all devices used to access the Internet. Web servers automatically log the IP addresses of visitors to their sites. The IP address, on its own, does not identify an individual. However, in certain circumstances, such as with the co-operation of an ISP for example, it could be used to identify an individual using the site. Unless otherwise noted, PSP Investments does not automatically gather any specific information from you, such as your name, telephone number or email address. PSP Investments would obtain this type of information only if you supply it to us, for example, by email or by submitting such information to use on our Career Opportunities site. In cases where services are provided by organizations outside of PSP Investments, such as through Workday, the service provider for our Career Opportunities site, IP addresses may be recorded by the Web server of the third-party service provider. A specific privacy notice governing the treatment of personal information submitted to the Career Opportunities Site is available when applying on that site.
2. Communicating with PSP Investments via e-mail, social media platform or by other means
If you choose to send us an email or communicate with us via a social media platform (either privately or publicly) or by other means, your personal information is used by PSP Investments in order to respond to your inquiry or pursue a business interest. The information you provide will only be shared with another government institution if your inquiry relates to that institution. PSP Investments does not use this information to create individual profiles nor does it disclose the information to anyone other than to those individuals within PSP Investments who need to provide you with a response. Any disclosure of your personal information in this context will be done in accordance with the Privacy Act and other applicable privacy laws. Emails and other electronic methods used to communicate with PSP Investments may not be secure and PSP Investments cannot guarantee the confidentiality of communications initiated by email or via a social media platform. Therefore, it is recommended that you do not send sensitive personal information, such as your Social Insurance Number or your date of birth, through electronic means.
Personal information from emails in order to make inquiries is collected pursuant to Section 5 of the Public Sector Pension Investment Board Act. Such information may be used for statistical, evaluation and reporting purposes and is included in the Public Communications Personal Information Bank (PSPIB PSU 914).
3. Digital Markers (including cookies)
A digital marker is a resource created on your device by a visited website’s Web server in order to remember certain pieces of information for the Web server to reference during the same or subsequent visit to the website. Examples of digital markers are “cookies” or HTML5 web storage. Some examples of what digital markers do are as follows:
- allow a website to recognize a previous visit each time the visitor accesses the site – which is necessary to remember settings, such as language;
- track what information is viewed on a site – which helps website administrators enhance their website to ensure visitors easily find what they are looking for; track visitors across multiple sites, in the case of third-party cookies – which helps derive knowledge (interests, preferences, etc.) about individuals, notably for relevant advertisement.
PSP Investments uses sessional and persistent digital markers on some portions of its website. During your visit on our website, your browser exchanges data with PSP Investments’ Web server. The digital markers used do not allow PSP Investments to identify individuals. PSP Investments will only allow digital markers to be installed on your device if you consent to it by selecting your preferences from our “cookie banner” on your first visit, unless it is a strictly necessary cookie. Those are generally of technical nature, for instance remembering your cookie preferences or securing the Website. If you consent to it, PSP Investments’ website also allows some third-party cookies to be installed on your device. You can find more information in our Cookie Declaration. You can always control what cookies you allow from PSP Investments’ website on our Cookie management tool in Cookie Settings.
4. Web Analytics
Web analytics is the collection, analysis, measurement, and reporting of data about Web traffic and visits for purposes of understanding and optimizing Web usage and user experience.
PSP Investments uses Web analytics to improve its website. When your device requests PSP Investments’ Web page, our institution collects the following types of information for Web analytics:
- the originating IP address
- the date and time of the request
- the type of browser used
- the page(s) visited
- the type of device used
- the frequency of visits
- the duration of visits
- the traffic sources
PSP Investments uses Google Analytics as a third party service provider. Your IP address is anonymized prior to being stored on the service provider’s servers in order to safeguard your privacy. The information collected is anonymized according to the method described in Google’s Analytics Help.
Data collected for Web analytics purposes may be sent to, and stored in, locations outside of Canada, such as the United States and other countries where Google’s servers are located and may be subject to the governing legislation of those countries (for example the USA Patriot Act).
Information used for the purpose of Web analytics is collected pursuant to the Section 5 of the Public Sector Pension Investment Board Act. Such data may be used for communications and information technology statistical purposes, audit, evaluation, research, planning and reporting.
5. Protecting the Security of PSP Investments Websites
PSP Investments employs tools to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. These tools receive and record the IP address of the computer that has contacted our website, the date and time of the visit and the pages visited. We make no attempt to link these addresses with the identity of individuals visiting our site unless an attempt to damage the site has been detected.
This information is collected pursuant to section 161 of the Financial Administration Act. The information may be shared with appropriate law enforcement authorities if suspected criminal activities are detected. Such information may be used for network security related statistical purposes, audit, evaluation, research, planning and reporting and is included in the Security Incidents Personal Information Bank (PSPIB PSU 939).
PSP Investments also processes your personal information in the context of recruitment. More information on the handling of your personal information, including information on the retention of your personal information and legal basis for processing of your personal information in the context of the recruitment process can be found in our privacy notice for recruitment when you apply for a position from our Career Opportunities Page.
7. Inquiring about these Practices
Any questions, comments, concerns or complaints you may have regarding PSP’s practices and compliance with the Canadian Laws, the GDPR , the UK DPA, the CCPA, other applicable legislation, our privacy policies or regarding PSP Investments’ Web presence may be directed to our Access to Information and Privacy Coordinator in writing at 1250 René-Lévesque Boulevard West, Suite 1400, Montreal, Quebec, Canada H3B 5E9 or at ATIP@investpsp.ca.
If you are not satisfied with PSP Investments’ response to your privacy concern(s), depending on your residency, you may wish to contact the Office of the Privacy Commissioner by telephone at 1-800-282-1376, the UK Information Commissioner’s Office, your local data protection authority or the California Attorney General.
8. Updates to the Privacy Notice:
This Privacy Notice may be updated periodically to reflect changes to our personal information practices or applicable law. The revised Privacy Notice will be posted on the Website and in certain circumstances we may notify you of any changes by email. We encourage you to refer to this Privacy Notice often for the latest information about our personal information practices.
Part IV: Definitions
In this Privacy Notice, the following terms have the following meanings:
“administrative purpose” means the use of an individual’s personal information in a decision-making process that directly affects that individual.
“ATIP Coordinator” means the PSP Investments official appointed to this position.
“personal information” means information about an identifiable individual that is recorded in any form, including (without restricting the generality of the foregoing):
- information relating to the race, national or ethnic origin, colour, religion, age or marital status of the individual; information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved;
- any identifying number, symbol or other particular assigned to the individual;
- the address, fingerprints or blood type of the individual;
- the personal opinions or views of the individual except where they are about another individual or about a proposal for a grant, an award or a prize to be made to another individual by a government institution or a part of a government institution specified in the regulations under the Privacy Act;
- correspondence sent to a government institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to such correspondence that would reveal the contents of the original correspondence;
- the views or opinions of another individual about the individual;
- the views or opinions of another individual about a proposal for a grant, an award or a prize to be made to the individual by an institution or a part of an institution referred to in the fifth bullet above, but excluding the name of the other individual where it appears with the views or opinions of the other individual, and
- the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual.
For the purposes of use and disclosure of personal information described above strictly under the Privacy Act, “personal information” does not include:
- certain information about officers, employees of PSP Investments and other government institutions that relates to the position or functions of the individual and business contact information, as set out in more detail in the Privacy Act;
- information about an individual who is or was performing services under contract for PSP Investments that relates to the services performed, including the terms of the contract, the name of the individual and the opinions or views of the individual given in the course of the performance of those services;
- information relating to any discretionary benefit of a financial nature, including the granting of a license or permit, conferred on an individual, including the name of the individual and the exact nature of the benefit, and
- information about an individual who has been dead for more than twenty years.