The Canadian Real Estate Association (CREA) is a national trade association representing some 100 Real Estate Boards, 10 Provincial Real Estate Associations, one Territorial Association and all licensed brokers and salespersons (REALTORS®) who are Members of those organizations. CREA's mission is to represent and promote the interests of its Members, enhance Member professionalism and ability to succeed, and advocates policies that ensure real estate property rights and ownership.
The Privacy Code of The Canadian Real Estate Association
In 2001, the members of The Canadian Real Estate Association approved the adoption of a national Privacy Code. This Code, which applies to all member Boards, Associations, brokerage firms, brokers and salespersons, is comprised of the 10 Principles of privacy, which set in place a solid foundation within which the REALTOR® community can protect the confidentiality of the Personal Information of its customers, clients and the general public. CREA adheres to and abides by the Principles set out in the Privacy Code. Those Principles have been incorporated into this Policy, which is intended to outline CREA's practices with regard to the collection, use and disclosure of Personal Information.
For the purpose of this Policy: "Personal Information" means any information about an identifiable individual but does not include:
- The name, title, business address or telephone number of an employee of an organization;
- Aggregated information that cannot be associated with a specific individual.
"Member" includes, for the purpose of this Policy, licensed brokers and salespersons belonging to member Boards/Associations and individuals belonging either directly to CREA or to Councils of CREA.
Collection, Use & Disclosure of Personal Information
CREA may collect Personal Information of Members directly from the Member. Personal Information may also be provided to CREA by the Board/Association, which is collected at the time of the individual's application for membership. CREA's Privacy Code requires that the collection of such information by the Board/Association be done with the informed consent of the individual.
CREA may also collect personal information when an individual interacts with CREA electronically through CREA’s information technology systems, websites, email, and social media properties. This is done to recognize a user when that person returns to a site, allow the websites to work correctly, evaluate the use of the websites and support the use of website analytics. For example, CREA uses "cookies" and obtains certain types of technical information when a web browser accesses one of CREA’s websites. This type of technical information may include an individual’s internet protocol address and computer’s operating system and browser type, the address of a referring website, if any, and the path an individual takes through our web pages. Also, through the use of social media networks, an individual may disclose personal information that CREA may collect and link to information it has about an individual.
Information on properties listed for sale on Board MLS® Systems may be provided to CREA by Boards/Associations for display on CREA's property database websites. This information is collected by the listing salesperson, and may be Personal Information if it can be associated with an individual.
CREA at all times adheres to applicable legal or regulatory requirement(s) concerning the storage and protection of personal information. While CREA is the custodian of the Personal Information provided to it, it does use third party service providers. Some of these service providers and the databases where they store personal information are located outside of Canada. Where Personal Information is located outside of Canada, it is subject to the laws of that jurisdiction in which it is located.
Use & Disclosure
CREA uses the personal information provided to it for various purposes, all of which are intended to fulfill its obligations as a national trade association and further its mission statement. These purposes include:
- Providing leadership, support, counsel and representation on behalf of organized real estate;
- Providing products, services, information and advice to individual members and Boards/Associations;
- Operating and maintaining its residential property website (REALTOR.ca), its commercial property website ( www.icx.ca ) and its Intranet site ( www.realtorlink.ca;www.lienimmobilier.ca );
- Administering and facilitating membership in the Boards/Associations across Canada;
- Administering trademark and competition law compliance programs; Furthering national policies; Ensuring compliance with bylaws, rules and regulations of CREA and Boards/Associations;
- Administering CREA's REALTOR® Code; Meeting any legal or regulatory requirements;
- Any other purposes consistent with CREA's mission statement and strategic plan.
Disclosure to Third Parties
Certain personal information of Members, (name, licensed status, firm name and business contact information) is available to other Members of CREA through REALTOR Link®, a password-protected Intranet site. CREA may also disclose Personal Information of Members to Boards/Associations or real estate regulators for membership or related purposes.
CREA may also disclose personal information of Members to third parties, such as lawyers, consultants, affinity partners or others who work with CREA to collect and analyze information from Members, to improve the products and services offered by CREA or to provide products and services to Members. Some of these third parties may send information to or contact the individual as part of membership surveys.
Personal information may only be provided to organizations providing services to CREA if they agree to use such information solely for the purposes of providing services to CREA and under the instruction of CREA and, with respect to that information, to act in a manner consistent with this Policy.
Use and Disclosure Without Consent
In certain circumstances, CREA may be permitted or required by law to disclose Personal Information without consent. Those circumstances may include:
- Where the information was public;
- Where required by law;
- Where it is necessary to collect dues;
- Where it is necessary to protect the rights of an identifiable person or group;
- Other circumstances recognized by the privacy legislation as permitting disclosure without consent.
Protecting Personal Information
CREA takes reasonable steps to protect information from unauthorized access or disclosure in a manner commensurate with its sensitivity, value and criticality. This Policy applies regardless of the media on which the information is stored, the location where the information is stored, the systems used to process the information or the processes by which information is handled.
The measures used to protect Personal Information include physical measures (e.g. locked filing cabinets), organizational measures (e.g. information is available to other persons only on a need-to-know-basis) and technological measures (e.g. computer passwords).
While CREA puts in place reasonable precautions, we cannot guarantee at all times the security of the information. No method of transmitting or storing data is completely secure, particularly with regard to Internet applications.
CREA attempts to insure the personal information under its control is as accurate, complete, current and relevant as is necessary for its identified purpose. Personal information of Members which is uploaded directly to CREA's database by Member Boards/Associations is the responsibility of the Member and or the Boards/Associations. Listing information uploaded by the Boards/Associations to CREA's property database websites is the responsibility of the listing REALTOR® and/or the Board/Association. Information in closed files is not updated or maintained.
CREA retains Personal Information as long as is necessary to fulfill the purpose for which it was collected. CREA has in place a Record Retention and Destruction Policy consistent with the nature and need for the information and legislative requirements. Access to Personal Information Individuals may request access to any Personal Information about themselves retained in CREA records. All access requests must be in writing and must be directed to CREA's Chief Privacy Compliance Officer. Access requests must be accompanied by appropriate identification satisfactory to CREA. CREA has the right prior to responding to any access requests, to take whatever steps it deems necessary to confirm the identify the person making the request. CREA will endeavour to provide any applicable information within 30 days of the date of the request. CREA may charge a nominal amount for costs incurred in providing the information. Where an individual believes that the personal information in the CREA file is inaccurate, he or she may have appended to the record any alternative information, where CREA is of the view that the appended information is, in fact, correct.
CREA has the right to decline to provide access to personal information in a number of circumstances, including where the information:
- Is subject to solicitor-client privilege;
- Could interfere with law enforcement, investigative or regulatory functions;
- Would disclose of personal information of another individual;
- Would cause serious harm to another individual;
- Is confidential business information that may harm CREA or the competitive position of a third party;
- Any other circumstances recognized by the privacy legislation. Where the information cannot be disclosed, the individual making the request will be provided with the reasons for non-disclosure.
Where to Direct Questions
Any questions or concerns relating to the collection, use or disclosure of Personal Information by CREA may be directed to:
The Chief Privacy Compliance Officer (CPCO),
The Canadian Real Estate Association
200 Catherine Street, 6th Floor Ottawa, ON K2P 2K9
Phone: (613) 237-7111
Fax: (613) 234-2567
All potential privacy breaches should be brought to the attention of the CPCO as soon as possible even if it is unclear whether a privacy breach has occurred or its level of severity.