PRIVACY POLICY

A. Purpose

Canada Infrastructure Bank (“CIB” or “we”) is committed to protecting your personal information and complying with its obligations under the Privacy Act, the Privacy Regulations and applicable policies, directives, and guidelines of the Treasury Board of Canada Secretariat (“Treasury Board”). In the course of our daily activities, the CIB may collect personal information from individuals, to provide services, make decisions and support its business operations, programs, and activities.

The purpose of this Privacy Policy is to describe the CIB’s measures adopted with respect to the collection, use, disclosure, protection, and handling of personal information in relation to its business operations, programs, and activities, including through our website – https://cib-bic.ca (“Website”) – and through other interactions with individuals, including managing investment activities.

This Privacy Policy does not apply to the collection and processing of the CIB’s employees’ personal information. Employees should refer to the CIB’s chapter in Info Source: Sources of Federal Government and Employee Information for information about the functions, programs, activities, and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act.

B. Personal Information

“Personal information” is information about an identified or identifiable individual, including name, mailing address, email address, telephone number, signature, a personal opinion, and other information relating to an individual. Depending on the jurisdiction in which you are located, certain business contact information may be excluded from the meaning of personal information.

The CIB may collect, use, and disclose personal information under the authority of section 5 of the Canada Infrastructure Bank Act and, in the case of Website security, pursuant to section 161 of the Financial Administration Act. Through the federal government publication Info Source: Sources of Federal Government and Employee Information, the CIB publishes personal information banks (“PIBs”) which lists all the types of personal information collected by the CIB.

C. Guiding Principles  

The CIB is responsible for the protection of personal information under its control, both within the organization and when business activities are carried out by a third party on behalf of the CIB. The CIB’s ability to protect personal information requires ethical and responsible behaviour from our employees and applicable third parties, in accordance with the 10 following guiding principles:

1. 1. Accountability – the CIB is responsible for the personal information under its control. This includes the personal information of employees, business partners, as well as proponents of, or private sector investors or institutional investors in, infrastructure projects.
2. 2. Identifying purposes – Through this Privacy Policy, the CIB identifies the purpose for collecting personal information before or at the time of collection.
3. 3. Consent – the CIB practices informed consent, which can be either express or implied. Consent is considered meaningful when individuals are provided with clear information explaining what the organization is doing with their information, such as through this Privacy Policy.
4. 4. Limiting collection – the CIB will only collect personal information for the purpose that was identified. Personal information is collected under the authority of the Privacy Act, the Financial Administration Act, and the Canada Infrastructure Bank Act.
5. 5. Limiting use, disclosure, and retention – the CIB requests additional consent if it wants to use personal information for any new or additional purpose. CIB retains personal information only as long as necessary.
6. 6. Accuracy – Personal information is complete, accurate and up to date. This also applies to personal information provided to third parties.
7. 7. Safeguards – the CIB safeguards personal information with the level of protection appropriate to the sensitivity of the information. Employees are aware that confidentiality of personal information must be maintained.
8. 8. Openness – the CIB is open about its policies and practices for the management of personal information.
9. 9. Individual access – Subject to the exceptions in the Privacy Act, individuals have a right to access to their personal information collected by the CIB. This includes the ability to correct or amend any personal information that is not accurate.
10. 10. Providing recourse – Individuals can challenge the CIB’s compliance with the above principles.

D. Personal Information the CIB Collects and Uses

The CIB does not contact individuals to request their personal information. It is your choice to provide personal information to us. We only collect your personal information if it relates directly to the CIB’s operating programs or activities and for the following business purposes:

• when you visit our Website;
• when you sign-up to receive communications from the CIB, such as current employment opportunities or other updates;
• when you apply for employment with the CIB, or otherwise provide us with a copy of your resume or other employment-related information;
• in connection with an infrastructure investment program administered by the CIB;
• in connection with meetings, events, conferences, or other activities organized or sponsored by the CIB;
• in connection with public consultations, opinion surveys, focus groups or feedback;
• in the course of the CIB’s project assessment process and due diligence activities;
• when you contact us with a comment or question or otherwise provide us with personal information.

The CIB’s collection and use of personal information is required for us to deliver our purpose and functions under the Canada Infrastructure Bank Act, and without which we would not be able to undertake certain activities. The CIB will not, without your consent, use your personal information under its control except for the purpose for which the information was obtained or compiled by the CIB or for a use consistent with that purpose.

We rely on you for the accuracy and completeness of the personal information you provide to the CIB. To ensure that there is no interruption in our communications with you, please contact us to advise of any changes in your information. CIB’s contact information is set out in section I “Individual Rights: Providing Access and Accuracy of Personal Information” below.

1. Visiting CIB’s Website

We collect information about how you use our Website. Even though this information is not linked to your identity, it can be in certain circumstances by using cookies. Therefore, we consider this data to be personal information as well when linked to your identity. The data we collect includes:

• the pages of our Website viewed;
• the date and time when those pages were viewed;
• the region where you are connecting from (geolocation);
• how long each page was viewed; and
• the web browser used (Chrome, Edge, Firefox, Internet Explorer, Opera, etc.), browser settings and the type of device used (Mac or PC, mobile or desktop, etc.)

We may offer you the opportunity to engage with the CIB or its content on or through third-party social networking websites, plug-ins, and applications. When you engage with us on or through third-party social networking websites, plug-ins, and applications, you may allow us to have access to certain information associated with your social media account (e.g., name, username, email address, profile picture) to deliver content or as part of the operation of the website, plug-in, or application.

Please see section H “CIB Website and Online Privacy” below for more details about the Website’s collection, use and disclosure of personal information.

2. Signing Up for CIB Communications

We may provide you with an opportunity to sign-up to receive CIB communications by email, such as news and updates, or other information that may be of interest to you. If you choose to sign-up to receive CIB communications, we may collect personal information such as your name, email address, and your language of preference.  The CIB has structured its practices to comply with the consent and unsubscribing requirements under Canada’s Anti-Spam Legislation (CASL). You can opt-out of receiving these communications at any time by clicking on the unsubscribe link included in our email communications or by contacting us. Please note that if you unsubscribe, you may continue to receive certain non-marketing electronic communications from us.

3. Applying for Employment at the CIB

In connection with a job application through the Careers section of the Website, you may provide us with certain personal information about yourself (such as that contained in a resume, cover letter, transcript, or similar employment-related materials). We may also obtain employment-related information that you publicly post to social media websites such as LinkedIn.  We use this information to evaluate your qualifications and suitability for the desired position and to process and respond to your application.  We may also keep this information on file to consider you for future job opportunities or to otherwise meet legal or business requirements. We may also collect optional demographic information, which we use on an aggregated basis for the purpose of supporting our employment equity and diversity initiatives and better understand our applicants.

We may also obtain your consent to collect additional personal information during reference check and background verifications processes.

4. Infrastructure Investment Programs Administered by the CIB

From time to time, the CIB may establish infrastructure investment programs and solicit investment proposals from proponents. We use your personal or business information as part of our due diligence to determine if you or your investment proposal meet the program’s eligibility requirements and priorities and to administer the program and the investment proposal and to enforce the CIB’s rights. With your consent, the CIB may also share your personal or business information to facilitate introductions to federal, provincial, municipal, Indigenous and industry partners to help advance your infrastructure project.

We also collect banking information to process payments and other transactions. In some circumstances, information is shared with counterparties and their respective banks in relation to fund transfers, payments, drawing of cheques, and other transactions.

5. Meetings, Events, Conferences and Other Activities

From time to time, the CIB may organize or sponsor meetings for discussion, events, conferences, or similar activities. In the course of these activities, we may collect personal information or participants such as name, email address and contact information to administer registration for the meeting, event, conference, or other activity. For example, the CIB may collect the name, email address and contact information of individuals who register to attend the CIB’s Annual Public Meeting.  This information is used to communicate with the participants registered for the meeting, event, conference, or other activity.

6. Public Consultations, Opinion Surveys, Focus Groups or Feedback

The CIB or its authorized survey, polling or other service providers may conduct public consultations, opinion surveys, focus groups or solicit public feedback in which individuals participate to support the fulfillment of our mandate. During these activities, the CIB may obtain consent from participants to collect and use personal information such as first and last name, email address, telephone number, and mailing address for the purpose of conducting research and/or public engagement. Reports generated from such public consultation will be provided to the CIB in aggregate form and in a manner that does not identify any individual participant.

7. Project Assessment and Investment Activities

To ensure that we do not, directly, or indirectly, unknowingly transact business with companies and/or individuals who present legal, regulatory, and reputational risks to the CIB, we use information to detect and assess potential legal, regulatory, and reputational risks in transactions involving the CIB and various counterparties. For example, during the CIB’s project assessment and investment activities, we may collect personal information about individuals, including, but not limited to, members of the boards of directors (or similar) or management, clients, or suppliers, of entities in which the CIB is providing advisory services or considering an investment. The information we collect may include information obtained through background verifications and collected from third party databases in the context of detecting and assessing potential legal, regulatory, and reputational risks in transactions involving the CIB and various counterparties.  The third-party databases contain profiles of companies and/or individuals who present risks for assorted reasons including being named on official lists, such as terrorism, corruption, or sanctions lists, being identified as politically exposed, being investigated, charged, or convicted for illegal activities, being subject to allegations of wrongdoing or being subject to adverse media. Profiles may contain personal information such as name, alias, birth date, country of birth, country of residence, principal occupation, family members, known associates and past convictions.

We collect and use this information to conduct due diligence regarding potential investments, to manage our investments and to meet ‘know your client’ requirements, as required by applicable law. The CIB uses this information to comply with industry best practices and with Canadian laws including the Corruption of Foreign Public Officials Act, Proceeds of Crime (Money Laundering) and Terrorist Financing Act, United Nations Act, Special Economic Measures Act, Freezing Assets of Corrupt Foreign Officials Act and the Criminal Code of Canada.

8. Questions, Comments and Complaints

If you contact us with a comment, question, or complaint, you may be asked for information that identifies you (such as your name, address, and a phone number) along with additional information we need to help us promptly answer your question or respond to your comment or complaint. We may also retain this information to assist you in the future. The information you provide will only be shared with another government institution if your inquiry relates to that institution. The CIB does not use this information to create individual profiles, nor does it disclose the information to anyone other than to those individuals within the CIB who need to provide you with a response.

Emails and other electronic methods used to communicate with the CIB may not be secure and the CIB cannot guarantee the confidentiality of communications initiated by email. Therefore, it is recommended that you do not send sensitive personal information, such as your Social Insurance Number or your date of birth, through electronic means.

E. Disclosing Personal Information within the CIB and to Third Parties

Except as set out herein, we will not disclose, trade, rent, sell, or otherwise transfer personal information to third-party vendors, without your consent. Any disclosure of your personal information is in accordance with the Privacy Act.

1. CIB Employees or Representatives

Our employees or representatives may have access to personal information on a need-to-know basis to perform their work related to the CIB’s activities, such as responding to your question or conducting know your client due diligence regarding potential investments. They will not view your personal information for any other reason.

2. Service Providers

We may transfer (or otherwise make available) your personal information to third party service providers (including cloud-based providers) such as: IT (Information Technology) services, web analytics, human resources, legal and accounting service providers.  For example, we may use service providers to conduct background verifications (including with regards to ‘know your client’ requirements), send our emails, to perform analytics and reporting, host our Website and operate certain of its features. Our service providers are given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal information for their own marketing or other purposes.

We carefully select our service providers to ensure that your privacy and personal information are protected and that the CIB’s requirements under the Privacy Act are fully respected. In all such cases, we will only transfer your personal information if we have put in place appropriate safeguards in respect of the transfer, for example, industry standard contractual clauses. You may obtain a copy of the safeguards we use in respect of such transfers by contacting us as indicated below.

Some of our service providers are based outside Canada and some in the United States. They may store or process your personal information on our behalf. For instance, under the USA Patriot Act, they might be forced to disclose your personal information to U.S. authorities if they suspect that it is linked to terrorism or money laundering activities.

3. Legal Requirements

The CIB and our Canadian, U.S. and other service providers may provide your personal information in response to a search warrant or other legally valid inquiry or order (which may include lawful access by Canadian, U.S. or other foreign governmental or investigative authorities, courts or law enforcement agencies), to an organization in the case of a breach of an agreement or contravention of law, to detect, suppress or prevent fraud, or as otherwise required or permitted by applicable Canadian, U.S. or other law. We may also disclose personal information where necessary for the establishment, exercise or defence of legal claims or disputes, and to investigate or prevent actual or suspected loss or harm to persons or property.

F. How Long Is Your Personal Information Retained?

We retain personal information as long as we need it: (i) for business purposes to fulfill our mandate, (ii) in connection with litigation, investigations, or proceedings, and (iii) as required or permitted by applicable law. As part of its Information Management Policy, the CIB has adopted a document retention schedule that sets out retention periods for various categories of personal information the CIB holds. The document retention schedule is reviewed and updated periodically and is subject to any legal obligations to retain certain information. As a rule, personal information that has been used by the CIB for an administrative purpose (i.e., a decision-making process that directly affects the individual) is retained for at least two years following the last time the information was used for such purpose, unless the individual consents to its disposal. Where a request for access to personal information has been received, the personal information subject to such request is retained until the requesting individual has had the opportunity to exercise all their rights under the Privacy Act, the Access to Information Act, or any other applicable legislation with respect to such personal information.

In accordance, with legal requirements and applicable guidelines, the CIB will destroy, erase, render anonymous, or otherwise dispose of personal information after such retention period has elapsed. As a federal Crown corporation, the CIB is also subject to the provisions of the Library and Archives of Canada Act when disposing of records containing personal information.

G. Safeguarding Your Personal Information

We take our responsibility to protect the confidentiality and integrity of your personal information very seriously. We are committed to managing your personal information in accordance with applicable laws, industry standard security practices and the CIB’s procedures in respect thereof.

We have implemented reasonable administrative, technical, and physical security procedures to safeguard and protect your personal information against loss, theft, unauthorized disclosure, copying, and unauthorized use or modification. We maintain appropriate safeguards and security procedures that reflect the types of documents, including electronic or paper records, organizational measures including security clearances and limiting access on a "need-to-know" basis, and technological measures such as the use of passwords, encryption, and firewalls.

While we have taken reasonable efforts to protect your personal information, we cannot guarantee the security of electronic systems or email and cannot be held responsible for unauthorized or unintended access that is beyond our control. We also cannot guarantee, warrant, or represent in any way that the personal information you provide will be transmitted securely or protected completely against interception, loss, misuse or alteration and we strongly recommend that you use appropriate discretion before transmitting sensitive personal information electronically.

H. CIB Website and Online Privacy

This section provides additional information about how we manage the collection, use, disclosure, retention, and access to your personal information online, including our Website.

The CIB’s Website does not automatically gather any specific personal information from you, such as your name, phone number or e-mail address. We will only obtain this type of information if you supply it by sending us an e-mail or registering in a secure portion of the Website. Please note that we may monitor any part of our Website at any time and may respond appropriately to curtail inappropriate use.

1. Digital Markers (including cookies)

When you visit our Website, we collect your IP (Internet protocol) address and other related information such as page requests, browser type, operating system and average time spent on our Website. We collect these types of personal information using automated means, including digital markers (including cookies).

A digital marker is a resource created by a visited website’s Web server to remember certain pieces of information for the Web server to reference during the same or subsequent visit to the website. Examples of digital markers are “cookies” or HTML5 web storage.

Cookies are small files that are downloaded to the device you use to visit a website. They are used to help improve visitors’ experiences on the site, by, for instance, remembering preferences, log in information, or otherwise recognizing that they have visited the site previously (or are the same user during a single visit). They are also used to track what information is viewed on a site which helps website administrators ensure visitors find what they are looking for and make improvements to the site based on visitor behaviour. In some cases, they are used to collect and store information about specific users.

The CIB uses sessional and persistent digital markers on some portions of its Website.

• A session cookie is a small text file placed on your browser by a web server. It acts as an identification card because it is unique to the user but can only be read by the web server. Session cookies improve site navigation by maintaining information from page to page within these applications. Session cookies are deleted from your computer hard drive when you close your web browsing software.
• A persistent cookie is more permanent and remains on your computer or other Internet-connected device for a certain period after you close your web browsing software unless you delete them. A persistent cookie acts as your identification card and can only be read by the web server.  At CIB, we use persistent cookies to help us remember your official language preference and to better understand how you access, navigate, and use our Website.

By accessing the CIB’s Website, you consent to the use of digital markers and agree to have their browser set to accept digital markers, including cookies.

You can choose to prevent cookies from being downloaded to your device by blocking some or all of them. However please note that if you do this you may not be able to use the full functionality of the site. You can also delete cookies that have already been downloaded.

2. Web Analytics

Web analytics is the collection, analysis, measurement, and reporting of data about Web traffic and visits for purposes of understanding and optimizing Web usage. Information in digital markers may be used for the purpose of web analytics to remember your interactions with CIB’s Website.

The CIB uses Web analytics to improve its Website. We collect the following types of information for Web analytics:

• the originating IP address
• the date and time of the request
• the type of browser used
• the page(s) visited
• the type of device used
• the frequency of visits
• the duration of visits
• the traffic sources

The CIB uses Google Analytics and the information collected is disclosed to Google and external third-party service providers. The user’s IP address is anonymized prior to being stored on the service provider’s servers to help safeguard the user’s privacy. The information collected is de-personalized by truncating the last 4 digits of your IP address. You can learn more about Google Analytics cookies here.  You can also choose to opt out of being tracked by Google Analytics.

Data collected for Web analytics purposes may be sent to, and stored in, locations outside of Canada, such as the United States and other countries where Google’s servers are located and may be subject to the governing legislation of those countries (for example the USA Patriot Act).

Information used for the purpose of Web analytics may be used for communications and information technology statistical purposes, audit, evaluation, research, planning and reporting.

3. Monitoring and Protecting Website Security

The CIB employs software programs that monitor network traffic and detect unauthorized attempts to upload or change information, or otherwise cause damage to the Website. These programs record the IP addresses of computers that visit the Website. They also record the date and time of visits, the page viewed, and the browsers and operating systems used by visitors. Such information may be used for network security related statistical purposes, audit, evaluation, research, planning and reporting. We do not attempt to link this information to the individual users unless an attempt to damage the Website has been detected. The information may also be shared with appropriate law enforcement agencies if suspected criminal activities are detected.

In cases where services are provided by organizations outside of the Website, such as third-party websites, social media platforms, or mobile applications, IP addresses may be recorded by the web server of the third-party service provider.

4. Third-Party Social Media

This Privacy Policy does not cover personal information you give to social media companies. The CIB’s use of social media serves as an extension of our Web presence. Social media accounts are public and not hosted on CIB servers. When you interact with the CIB through social media, you give information to social media companies and not to the CIB. This information is covered by each platform’s own privacy policy and you should read the terms of service/use and privacy policies of those third-party service providers. Keep in mind that information you publish on social media can be seen by others. The CIB has social media accounts with Threads, X (formerly Twitter), and LinkedIn.

Personal information that you provide to the CIB via social media accounts is collected to capture conversations (e.g., questions and answers, comments, "likes", retweets) between you and the CIB. It may be used to respond to inquiries, or for statistical, evaluation and reporting purposes. Comments posted that violate Canadian laws will be deleted and disclosed to law enforcement authorities. Comments that violate the CIB's Terms of Use will also be deleted.

5. Links to Other Websites

Our Website may contain links to other websites that operate independently from the CIB. We provide links to third party websites as a convenience to the user only. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements, notices, and terms of use, which we recommend you read carefully.  We do not have any control over such websites, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use, or disclose, secure and otherwise treat your personal information.

I. Individual Rights: Providing Access and Accuracy of Personal Information

The CIB is accountable to ensure that your personal information in our records is accurate and complete. Subject to the Privacy Act, you may access, update and correct inaccuracies in your personal information in our custody or control at any time.

Please contact us if:

• You have any questions or comments about this Privacy Policy;
• You wish to access, update and/or correct inaccuracies in your personal information in our custody or control;
• You otherwise have a question or complaint about the way we or our service providers manage your personal information.

You may contact us by email at atip-aiprp@cib-bic.ca or by mail at the following address:

Canada Infrastructure Bank 
Attn: Access to Information and Privacy Coordinator
150 King St. W., Suite 2309, P.O. Box 15
Toronto, ON M5H 1J9
Telephone: 1-833-551-5245

Please include sufficient details to enable us to search for relevant records. Our Access to Information and Privacy Coordinator will respond to you as soon as possible. The CIB has 30 days to respond in writing to your personal information request, subject to a time extension in certain specific circumstances, and there are no fees for requesting access to your personal information.

J. Complaints

The Privacy Act establishes a complaint mechanism whereby individuals can ask the Office of the Privacy Commissioner of Canada to investigate any concerns that they may have regarding alleged non-compliance by a federal government institution with any of the provisions of the Privacy Act.

If you are not satisfied with the CIB’s response to your privacy concern, you may wish to contact the Office of the Privacy Commissioner of Canada at the following address:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Telephone: 1-800-282-1376 (toll free)
(819) 994-5444
Facsimile: (819) 994-5424
Website: http://priv.gc.ca

K. Changes to this Privacy Policy

Because privacy concerns and legal and business requirements evolve continually, the CIB reserves the right to amend this Privacy Policy at any time, without notice or liability to you or any other person by posting a new or amended Privacy Policy on our Website. The updated Privacy Policy will supersede earlier versions and will also apply to personal information provided to the CIB previously. We therefore encourage you to refer to this Privacy Policy often for the latest information about our personal information practices.

This Privacy Policy is governed by the laws of Ontario and Canada. It was last reviewed and revised on November 1, 2023.