The BC GSAR Privacy & Access Awareness Course has been developed to help GSAR volunteers, team leaders, managers, and board members understand their responsibilities when handling personal and operational information. This training translates provincial privacy legislation into clear, practical guidance that can be applied during both emergency operations and routine team administration.

The Reality of Information in Search and Rescue

Every GSAR callout involves information. From the moment a team is activated, volunteers begin working with details that can be deeply personal and sensitive.

This may include missing person profiles, medical conditions, mental health considerations, family contact information, and operational planning details. In addition, teams maintain volunteer records, training documentation, incident reports, and communications logs. These records are essential for operational effectiveness, accountability, and learning from past incidents.

Because GSAR teams in British Columbia are registered societies and non-profit organizations, they are legally required to comply with the Personal Information Protection Act (PIPA). This legislation governs how organizations collect, use, store, and disclose personal information.

In practice, this means that GSAR teams must handle information carefully at every stage of an incident—from the first callout message to final reporting and records storage.

Why Privacy Matters in High-Pressure Environments

Search and rescue operations often move quickly. Volunteers may be receiving information over the radio, through messaging systems, from family members, or through coordination with police and emergency agencies. In these moments, the priority is always to locate and assist the subject as quickly and safely as possible.

However, even during high-pressure situations, privacy obligations still apply.

Improper handling of personal information can create serious consequences. Sensitive details shared outside appropriate channels can compromise the dignity and safety of missing persons or their families. Information released publicly or to the media without proper authorization can damage investigations or create confusion during an ongoing search.

Beyond the immediate operational risks, mishandling information can also lead to legal non-compliance with provincial legislation, loss of public trust, and reputational damage to individual teams and the broader GSAR community.

Trust is essential to search and rescue. Families must feel confident sharing critical details about a loved one. Communities must trust that responders will act with professionalism and discretion. Protecting personal information is a key part of maintaining that trust.

Turning Legal Requirements into Practical Skills

While privacy legislation can sometimes feel abstract, the goal of the BC GSAR Privacy & Access Awareness Course is to translate those legal requirements into practical actions that volunteers can apply in real situations.

The course is designed specifically for GSAR operations in British Columbia and uses realistic scenarios that volunteers may encounter in the field or during administrative work.

Participants will learn how to:

• Recognize what constitutes personal and sensitive information in GSAR contexts

• Apply privacy principles during active callouts and training exercises

• Manage operational records and volunteer information securely

• Respond appropriately to media inquiries and public communications

• Identify, report, and respond to potential privacy breaches

Importantly, the course emphasizes that privacy protection is not just the responsibility of board members or administrators. Every GSAR volunteer who handles operational information plays a role in protecting it.

Building Consistent Practices Across Teams

British Columbia has more than 70 volunteer GSAR teams operating across the province. While each team is unique in structure and community context, consistent standards for information handling benefit everyone.

Standardized privacy awareness training helps ensure that volunteers across teams understand the same core principles and expectations. This consistency strengthens cooperation between teams, improves professionalism, and reduces organizational risk.

It also ensures that new volunteers entering the GSAR system receive the same foundational understanding of privacy obligations as experienced members and leaders.

Supporting Professionalism and Public Trust

Search and rescue volunteers already demonstrate extraordinary dedication to their communities. They train extensively, respond to emergencies in difficult conditions, and support families during some of their most stressful moments.

Professional information management is another critical part of that service.

By completing the BC GSAR Privacy & Access Awareness Course, volunteers help ensure that the personal information entrusted to GSAR teams is handled with care, respect, and legal compliance. The training supports stronger operational practices, reduces risk for teams and societies, and reinforces the professionalism that the public expects from search and rescue organizations.

Ultimately, protecting privacy is about more than legislation. It is about respect for the individuals and communities that GSAR teams serve.

And just like every other skill in search and rescue, it is something that can—and should—be learned, practiced, and applied consistently.

Access to Information Under ATIA

The Access to Information Act (ATIA) gives Albertans the right to request records held by public bodies, including municipalities. “Records” include emails, reports, documents, and other materials in the custody or control of municipal staff. While transparency is a key principle, ATIA defines clear exceptions to protect sensitive information, such as legal advice, law enforcement records, or confidential business data.

Municipalities must establish processes to handle requests efficiently and lawfully. Requests may come from residents, media, or advocacy groups and must be responded to within specified timelines. Failure to comply can result in legal challenges, administrative penalties, and reputational harm.

Protecting Privacy Under POPA

The Protection of Privacy Act (POPA) sets new privacy rights for Albertans and outlines how municipalities can collect, use, or disclose personal information. POPA allows municipalities to conduct data matching or create non-personal datasets for planning and analytics, provided privacy is protected.

Staff must manage personal information responsibly at all stages—from collection and storage to sharing and disposal. POPA emphasizes accountability, requiring clear policies, staff training, and security measures to safeguard residents’ data.

Why Municipalities Must Act

Transitioning from FOIP to ATIA and POPA is more than a legal update—it is an operational necessity. Without proper processes, municipalities risk:

• Legal exposure: mishandling requests or personal information can trigger complaints or penalties.

• Reputational harm: residents expect their information to be handled responsibly.

• Operational inefficiency: unclear procedures can waste staff time and resources.

Proactively adopting ATIA and POPA compliance measures ensures municipalities can respond efficiently to requests, protect sensitive data, and use non-personal information for evidence-based decision-making.

Equip Your Team With the Knowledge They Need

Our comprehensive course is designed specifically for municipal administrators, clerks, CAOs, department heads, elected officials, records officers, and contractors. Participants will learn to:

• Understand obligations under ATIA and POPA

• Respond to access requests lawfully and efficiently

• Manage personal information securely

• Develop policies, procedures, and training programs

• Reduce legal, reputational, and operational risks

• Leverage non-personal data for municipal planning

Through practical guidance and real-world examples, attendees will gain the confidence and skills to apply ATIA and POPA principles to everyday municipal operations.

Register Today

Enroll Here!

Alberta’s new access and privacy framework is here. Municipalities that act now can ensure compliance, protect residents’ data, and build public trust.

Attention Canadian and US-based Businesses!

Our comprehensive guide covers all the critical aspects of the Canadian Anti-Spam Legislation (CASL). You’ll learn the essential terms, how to report spam, enforcement agencies involved, contact center information, compliance tips, and best practices for businesses. Additionally, we’ll teach you how to obtain consent to send emails and record-keeping and provide examples of CASL consent forms and spam protection measures.

Understanding your obligations under the CASL is crucial to avoid costly breaches. Canada has the world’s strictest anti-spam laws, and we want to ensure you’re fully informed and compliant. Remember, non-compliance can lead to severe penalties.

Enroll today!

Many churches also operate daycares as a commercial activity, which requires additional training to adhere to specific guidelines when transitioning from general to commercial church activities.

To help church leadership teams better understand Canada’s Access and Privacy Legislation, I have developed a course on Privacy Regulations and the Church. The objective is to educate church staff, volunteers, and parents on the church’s principles, policies, and practices regarding their roles. The course covers the definition of personal information, examination of church and provincial/federal regulations, measures to safeguard personal information, and offers guidance and resources.

To take the course, click here.

Please note that this training gives learners an overview of legal opinions and information. Still, it is essential to comply with all federal, provincial/territorial legislation and not to consider it a replacement for legal advice.

It is all over the news, possible breaches of Alberta’s provincial Health Information Act (HIA). But who is doing the alleged breaching? Most recently, a couple Members of the Legislative Assembly of Alberta and a former City of Edmonton employee.

Let’s talk about MLA Thomas Dang, who currently sits as an independent member representing Edmonton-South. On November 4, 2022, he was handed a $7,200 fine after pleading guilty to a charge of illegally attempting to access private information. He admitted to hacking the province’s COVID-19 vaccine records portal using his computer.

Back in 2020, Tyler Shandro Alberta’s former Health Minister, became subject of two privacy breach complaints in just one month. The first of his complaints came from Dr. John Julyan-Gudgeon who filed a complaint with the Office of the Information and Privacy Commissioner (OIPC) after Alberta Health Services provided his personal cell number to Shandro. Shandro then used the number to call Dr. Julyan-Gudgeon at home, at night. The second complaint against Shandro comes after Shandro’s political staff accessed and released billing information from an Edmonton clinic to rebut allegations made during an NDP news conference.  When the OIPC receives complaints, they go through the normal process of determining whether an investigation is warranted, which takes a while.

On November 30, 2022, it became public that a former employee of the City of Edmonton accessed the personal information of more than 5000 employees in a data breach in May 2021 when he downloaded documents from city-owned computers onto a personal cloud-based account. The records include employee names and payroll numbers. Other files included management information, seniority lists and recall information for employees who were temporarily laid off.

The City of Edmonton recommends those who worked for them between 2018 and May 2021 who have questions about their privacy related to this incident to reach out to the office of the city clerk at 780-496-1551.

Churches, such as the one I will use in my training example, often also run daycares which is considered a commercial activity which requires additional training as there is more to know when church activity moves from general to commercial.

Want to learn more or set up privacy training in your church?

Please contact Shannyn at info@rustructconsulting.com for a FREE Training Workshop Workbook (PDF Download).

The Plan

Topic: Privacy Legislation and the Church

Question: Why do churches need to be concerned about privacy?

Objective: Train staff/volunteers (possibly parents) in the principles, policies, and practices of your church as it relates to their position.

Define: Personal Information

Explore: Church and Provincial/Federal Legislation

Action: Steps to Protect

Resources: Provide Tips 

**Disclaimer

This training content is a summary of legal opinion for the purpose of providing you information. Learners are advised that they are responsible to determine for themselves the requirements and implications of all federal, provincial/territorial legislation. This training is not intended as a substitute for legal advice.

Cyber Security and Digital Data Protection Concept. Icon graphic interface showing secure firewall technology for online data access defense against hacker, virus and insecure information for privacy.

Personal information Protection and Electronic Documents Act (PIPEDA) and your Business. PIPEDA is the federal private sector privacy law. The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA as well as the Privacy Act.

The Personal information Protection and Electronic Documents Act (PIPEDA) and Privacy Act are the laws established for how federal government institutions and commercial organizations, respectively, handle personal information.

The OPC’s core responsibility is to protect Canadian’s privacy rights. This is done by conducting investigations, promoting awareness and understanding of privacy rights and obligations, and providing advice to Parliament on the potential privacy implications of proposed legislation and government programs.

In brief, PIPEDA is the law that sets out the rules for the collection, use and disclosure of personal information during commercial activities.  Businesses must follow, regardless of their size, Ten (10) Fair Information Principles. They are Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use, Disclosure, and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

PIPEDA applies to most businesses across Canada except in Quebec, British Columbia and Alberta, where substantially similar Acts have been established, and therefore paramount. But be careful because PIPEDA still covers federally regulated industries, like transportation, telecommunications, and banking. Additionally, all business within Canada that handles personal information that crosses provincial or national boards are subject to PIPEDA, regardless of if you are in a province with substantially similar legislation or not. All Businesses in the three Canadian territories fall under PIPEDA.

Privacy is important because lack of awareness can potentially lead to complaints about your business, which may have an impact on your business’ reputation. Polls show that more than 90% of Canadians are concerned about their privacy.

Your organization is responsible for the personal information under its control. If you need assistance developing and implementing personal information policies and practices, or with training your staff, contact us today.

Source: Speaking Notes for the PIPEDA presentation package for businesses – Office of the Privacy Commissioner of Canada

Learn cybersecurity skills and how to stay safe online

When working online at the office or offsite, it is important to understand cyber threats and how to identify activities that may leave organizational/business information compromised.

Many small businesses are vulnerable to cyberattacks.

What is Cybersecurity?

Cybersecurity is the application of technologies, processes, and controls to protect vital organizational/business systems, networks, programs, devices, and data from cyber-attack(er)s.

Cyber-attacks and security incidents continue to increase; profit-motivated criminals looking to steal money or data or impact your operations.

Malicious and non-malicious threats use a wide range of tactics to target their unsuspecting people, processes and technology in organizations and businesses.

Threats

• Hackers: a person/thing who/that uses computers to gain unauthorized access to data
• Organized Crime: criminal activities that are planned and controlled by powerful groups and carried out on a large scale
• Hacktivists: a person who gains unauthorized access to computer files or networks to further personal/political ends
• Insiders (Malicious and Non-Malicious Activity): a person within a group or organization, especially someone privy to information available to others

Tactics and Techniques (used to target people, processes & technology)

• Ransomware Attacks: type of malicious software (malware) that threatens to publish or block access to data or a computer system.
• Unpatched Assets: are the vulnerabilities in a program or code that a company is aware of and will not or cannot fix.
• Malware: software that is specifically designated to disrupt, damage, or gain unauthorized access to a computer system.
• Business Email Compromise (BEC): a type of scam targeting companies who conduct wire transfers and have suppliers abroad.
• Distributed Denial of Service (DDoS): attacks are a subclass of denial-of-service attacks involving multiple connected online devices, collectively known as a botnet.
• Insider Threats: an insider threat is a security risk that originates within the targeted organization (employee, consultant, former employee, business partner, or board member).

For more information or to request a FREE PDF document, please email Shannyn at info@rustructconsulting.com

1. Have you replaced the system or process (administrative practices) that were described in your previous PIA submission?
2. Is your system locally hosted in your office space, or is your system hosted in a data centre or in the cloud?
3. Have you introduced new user access roles or groups?
4. Are you granting access to your system or exchanging information with another organization that was not mentioned in the mentioned PIA submission?
5. Have you added new ways of communicating with patients?
6. Have you added wireless access to your system?
7. Have you added remote access to your system?
8. Have you allowed access to your system via mobile devices, such as laptops, tablets, or smartphones?
9. Have you updated your privacy policies to reflect changes to legislation since your PIA was submitted?
10. Have you conducted a review of your privacy policies within the previous two years?

Answering “Yes” to questions 1-8 trigger the PIA update requirement.

Answering “No” to questions 9-10 triggers a review of your policies and make changes where necessary.

Let Shannyn help. Get a Quote today!

Shannyn Rus, CIAPP-P

SHANNYN RUS, CIAPP-P

Shannyn Rus, CIAPP-P has an understanding of and experience operationalizing access and privacy legislation supported by years of front line experience and progressive responsibility in dealing with access and privacy related matters.

From the University of Alberta, Shannyn holds the Information Access & Privacy Protection Certificate, and current professional designation with the Canadian Institute of Access and Privacy Professionals (CIAPP-P).

Shannyn is passionate about environments which are privacy conscious and works with you to help your organization create a ‘Culture of Privacy’ which also respects access to information legislation.

She supports business owners with the development of custom privacy programs and policies and by bringing current, informative and relevant training to you and your team.
Let Shannyn put her extensive knowledge of Canadian access and privacy legislation to work for you.

Opticians, have you recently gone virtual and would like to perform a Privacy Impact Assessment? Are you interested in training your staff on records management and destruction according?

PRIVACY IMPACT ASSESSMENTS (PIA)

Because privacy is risky business for all involved, it is important to know where your organization or business wants to be, as well as where you currently measure on a Privacy Gap Assessment.

There are a number of laws and jurisdictions involved, making it difficult to understand where to even start. Our team would begin with an assessment process to review the current state of your privacy compliance and provide you with a comprehensive audit report.

The Privacy Impact Assessment will advise you on potential risks related to privacy and mitigation recommendations to ensure your organization meets current privacy standards.

The systematic process to determine if basic privacy requirements are met, can be an extremely effective process and proactive tool to grow from while building privacy into your organizations structure and establishing ongoing accountability.

PRIVACY TRAINING
TWO New Online Training courses Available

The Personal Information Protection Act (PIPA) is Alberta’s private sector privacy law. The PIPA Online training course is a self-managed awareness training opportunity. It is intended to provide organizations and individuals a basic overview of the concepts of information access and privacy in relation in Alberta’s privacy legislation. A certificate of completion will be produced upon completion of all lessons and final quiz.

For public bodies, such as government departments and municipalities, please see the Freedom of Information and Protection (FOIP) of Privacy Training Course information. https://www.edu.rustructconsulting.com

PRIVACY POLICY DEVELOPMENT

Vital to an organizations or business’s privacy management framework are the polices, statements, procedures, and consent to use, disclose, and protection of information documents. The development of privacy framework pieces set the standards and practices for the way you or your staff manage the personal information in your care. Your commitment to privacy tells your clients their information is important and appropriate safeguards are in place for them to place trust in you and your business.

Shannyn collaborates with you to develop customized privacy policies, procedures, and guidelines to the unique needs of your business which are current under Canadian privacy legislation.

RUSTRUCT CONSULTING Opticians