Introduction

Maple Leaf Foods is committed to maintaining the accuracy, confidentiality, security and privacy of customer and employee personal information consistent with legislative requirements which govern its various Canadian operations. The Maple Leaf Foods’ Privacy Policy is a formal statement of principles and guidelines concerning the protection of personal information provided by Maple Leaf Foods to our Canadian customers and employees. The objective of the Maple Leaf Foods’ Privacy Policy is responsible and transparent practices in the management of personal information, in accordance with relevant legislation. This Policy addresses obligations imposed by legislation on Maple Leaf and does not impose any legal obligations in addition to the obligations created by statute.

To the extent applicable to its operations, the Maple Leaf Foods’ Privacy Policy adopts the provisions of Part 1 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”) (Statutes of Canada 2000, Chapter 5) and includes the ten principles of the Canadian Standards Association (CSA) Model Policy for the Protection of Personal Information referenced therein. To the extent provincial legislation is substantially similar to PIPEDA, compliance with PIPEDA will result in compliance with provincial legislative requirements.

Consent

By submitting personal information to Maple Leaf Foods and its Canadian affiliates, customers and employees agree that we may collect, use and disclose personal information in accordance with Maple Leaf Foods’ Privacy Policy.

LEGISLATIVE FRAMEWORK

The legislative framework governing privacy in Canada is a patch-work and as at 2003, evolving. Specifically, Maple Leaf’s operations are governed by privacy legislation in the following manner (as at December 2003).

PIPEDA’s General Scheme

Although PIPEDA is FEDERAL legislation, it stipulates that it will apply to both federally regulated and provincially regulated sectors (to the extent constitutionally permissible, and unless a province enacts legislation which the federal Privacy Commissioner concludes is “substantially similar” to the Federal PIPEDA legislation). In addition to PIPEDA, Alberta, British Columbia and Quebec have enacted privacy legislation. As at December 2003, only Quebec’s privacy legislation has been held to be substantially similar to PIPEDA.

Personal Information regulated by privacy laws falls within 2 broad categories, being employee personal information and customer personal information. The impact of privacy legislation on each such broad category is discussed below.

Customers

As defined by PIPEDA, “Customers” refer to identifiable individuals, as opposed to business organisations with whom Maple Leaf Foods carries on business activities. Therefore, while an individual who enters a contest, responds to a survey, or lodges a complaint with a consumer response centre is a “customer”, for purposes of PIPEDA, a grocery chain is not. PIPEDA governs privacy considerations that Maple Leaf Foods must comply with in dealing with customers.

Scope and Application of the Ten Principles of Privacy

The ten principles which form the basis of the Maple Leaf Foods’ Privacy Policy are interrelated, and Maple Leaf Foods shall adhere to the ten principles to the extent required by applicable statute. Each principle must be read in conjunction with the accompanying commentary. As permitted by the Personal Information Protection and Electronic Documents Act, the commentary in the Maple Leaf Foods’ Privacy Policy has been tailored to reflect personal information issues specific to Maple Leaf Foods.

Specifically, the scope and application of the Maple Leaf Foods’ Privacy Policy are as follows:

• The Policy applies to personal information about Maple Leaf Foods’ customers and employees that is collected, used, or disclosed by Maple Leaf Foods.
• To the extent required by applicable statute the Policy applies to the management of personal information under its control.
• The Policy does not impose any limits on the collection, use or disclosure of the following information by Maple Leaf Foods:

a) a customer’s name, address and telephone number, when listed in a public, professional or business directory or available through directory assistance;
b) an employee’s name, title, business address or business telephone number; or
c) other information about the customer or employee that is publicly available and is specified by regulation pursuant to the Personal Information Protection and Electronic Documents Act.

• The Policy does not impose an obligation to obtain consent to the collection, use or disclosure of employee personal information, to the extent that The Personal Information Protection and Electronic Documents Act or applicable provincial privacy legislation does not require consent from certain Maple Leaf Foods employees.
• The Policy does not apply to information regarding Maple Leaf Foods corporate customers; however, such information is protected by other Maple Leaf Foods’ policies and practices and through contractual arrangements.
• The application of the Maple Leaf Foods Privacy Policy is subject to the requirements and provisions of Part 1 of the Personal Information Protection and Electronic Documents Act, the regulations enacted thereunder, and any other applicable legislation or regulations, including any applicable order of any court. Maple Leaf Foods will rely on all exceptions and qualifications set out in applicable legislation even though those exceptions and qualifications may not be described in this Policy.
• This Policy does not alter, amend, or modify the terms and conditions set out in any collective agreement.

Definitions

agent — an authorized representative or service provider acting on behalf of Maple Leaf Foods.

Maple Leaf Foods — Maple Leaf Foods Inc. and its Canadian subsidiary and affiliated companies, as they may exist from time to time (including, without limitation, Canada Bread Company, Limited ) as well as employees and agents acting on behalf of Maple Leaf Foods.

collection — the act of gathering, acquiring, recording, or obtaining personal information from any source, including third parties, by any lawful means.

consent — voluntary agreement with the collection, use and disclosure of personal information for defined purposes. Consent can be either expressed or implied and can be provided directly by the individual, by his or her legal guardian or by a person having power of attorney for the individual.

customer — an individual who (a) utilises, or applies to utilise, the products or services of Maple Leaf Foods; or (b) corresponds with Maple Leaf Foods; or (c) enters a contest or other promotional activity sponsored by Maple Leaf Foods.

disclosure — making personal information available to a third party.

employee — a current or former employee or pensioner of Maple Leaf Foods including full time, part time and contract employees.

personal information — information about an identifiable customer or an employee, but does not include aggregate information that cannot be associated with a specific individual.

• For a customer, such information includes any recorded complaints, product comments, inquiries, contest entries, or resumes submitted.
• For an employee, such information includes information found in personal employment files, performance appraisals, pension and benefits information, but does not include the employee’s name, title, business address (including e-mail address) or business telephone or fax numbers.

service provider — a third party other than Maple Leaf Foods who uses personal information in order to provide services to Maple Leaf Foods, on a contract basis, an out source basis, or other business arrangement.

third party — an individual other than the subject customer, employee or his or her respective agent or an organization other than Maple Leaf Foods.

use — the treatment, handling, and management of personal information by and within Maple Leaf Foods, or any party to whom Maple Leaf Foods has contracted out certain business functions, or who provides business services to, or on behalf of Maple Leaf Foods.

The Maple Leaf Foods Privacy Policy in Detail

To the extent required by applicable legislation, principles governing Maple Leaf’s privacy obligations are set out in detail as follows:

Principle 1 — Accountability

Maple Leaf Foods is responsible for personal information under its control and shall designate one or more persons who are accountable for Maple Leaf Foods’ compliance with the following principles.

1.1 Responsibility for ensuring compliance with the provisions of the Maple Leaf Foods’ Privacy Policy rests with the senior management of Maple Leaf Foods, which shall designate one or more persons to be accountable for compliance with the Policy. Other individuals within Maple Leaf Foods may be delegated to act on behalf of the designated person(s) or to take responsibility for the day-to-day collection and processing of personal information.

1.2 Maple Leaf Foods has designated a Privacy Officer to oversee compliance with the Maple Leaf Foods’ Privacy Policy. The Maple Leaf Foods’ Privacy Officer may be supported by privacy officers at the operating company level. The Maple Leaf Foods’ Privacy Officer can be contacted at:

Privacy Officer: Jeffery Miller, Legal Counsel, Maple Leaf Foods Inc.
Maple Leaf Foods Inc.
16th Floor, 30 St. Clair Avenue West\
Toronto, Ontario M4V 3A2
e-mail: MillerJS@MapleLeaf.ca
phone: (416) 926-2011
fax:  (416) 963-6125

1.3 Maple Leaf Foods is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing, or other contracted services. Maple Leaf Foods shall utilise appropriate means to provide a comparable level of protection while information is being processed, or used in conjunction with delivery of contracted services by a service provider (see Principle 7).
1.4 Maple Leaf Foods shall implement policies and procedures to give effect to the Maple Leaf Foods’ Privacy Policy, including:
a) implementing procedures to protect personal information and to oversee Maple Leaf Foods’ compliance with the Maple Leaf Foods’ Privacy Policy;
b) establishing procedures to receive and respond to inquiries or complaints;
c) training and communicating to staff about Maple Leaf Foods’ policies and practices; and
d) developing public information to explain Maple Leaf Foods’ policies and practices.

Principle 2 — Identifying Purposes for Collection of Personal Information

Maple Leaf Foods shall identify the purposes for which personal information is collected at or before the time the information is collected.

2.1

(a) Maple Leaf Foods collects personal information for the following commercial purposes:
a) to establish and maintain responsible commercial relations with customers and to provide ongoing service, and communication with customers;
b) to understand customer needs, trends and preferences;
c) to evaluate, develop, enhance, market or provide Maple Leaf Foods’ products and services;
d) to manage and develop Maple Leaf Foods’ business and operations;
e) to meet legal and regulatory requirements;
f) to protect Maple Leaf Foods against error and fraud; and
g) for any other purpose to which an individual consents.

2.1(b) We collect, use and disclose employee personal information to establish, manage terminate and administer the employee relationship;
a) To recruit, train, motivate, identify, manage and maintain a superior workforce.
b) To foster harmonious employment relationships.
c) To administer policies, including investigations.
d) To manage and promote the Company’s businesses.
e) To administer compensation and benefits.
f) To acquire and transfer businesses.
g) To develop, manage and promote employee services, health, safety and security, and compliance with the Company’s requirements.
h) To protect Maple Leaf Foods against error and fraud;
For additional purposes for which Maple Leaf Foods may use or disclose personal information, please see Principle 5. Further references to “identified purposes” mean the purposes identified in this Principle and in Principle 5.

2.2 Maple Leaf Foods shall specify orally, electronically or in writing the identified purposes to the customer or employee at the time or before personal information is collected. Upon request, persons collecting personal information shall explain these identified purposes or refer the individual to a designated person within Maple Leaf Foods who shall explain the identified purposes.

2.3 Unless allowed by law Maple Leaf Foods shall not use or disclose for any new purpose personal information that has been collected without first identifying and documenting the new purpose and obtaining the consent of the customer or, where required by law, the employee.

2.4 In addition to identification of purposes for which personal information is collected, in Quebec, the source of the personal information must be identified where personal information is collected from a third party.

Principle 3 — Obtaining Consent for Collection, Use or Disclosure of Personal Information.

The knowledge and, where required by law, consent of a customer shall be obtained for the collection, use, or disclosure of personal information, except where inappropriate. The knowledge and consent of an employee shall be obtained, to the extent required by statute, for the collection, use or disclosure of personal information, except where inappropriate.

3.1 Maple Leaf Foods may use or disclose personal information without knowledge or consent in the case of an emergency where the life, health or security of an individual is threatened or reasonably perceived to be threatened. Maple Leaf Foods may also disclose personal information without knowledge or consent to a lawyer representing Maple Leaf Foods, to collect a debt, in investigations of breaches of laws, (and in the case of disclosure, there are reasonable grounds to believe the personal information relates to a breach of laws or agreements) to comply with a subpoena, warrant or other court order, or as may be otherwise required or authorized by law, or for statistical, scholarly or research related matters. To the extent that applicable privacy legislation, does not apply to Maple Leaf employees, or impose an obligation to obtain consent, Maple Leaf may collect, use, or disclose personal information without employee consent.

3.2 In obtaining consent, where required by applicable privacy law, Maple Leaf Foods shall advise customers or employees of the purposes for which personal information will be used or disclosed. Purposes shall be stated in a manner that can be reasonably understood by the customer or employee.

3.3 Generally, Maple Leaf Foods shall seek consent where required by law to use and disclose personal information at the same time it collects the information. However, Maple Leaf Foods may seek consent to use and disclose personal information after it has been collected, but before it is used or disclosed for a new purpose.

3.4 Maple Leaf Foods will not, as a condition of the supply of a product or service, require customers or employees to consent to the collection, use or disclosure of personal information beyond that required to fulfil the identified purposes.

3.5 Where consent is required by law, in determining the appropriate form of consent, Maple Leaf Foods shall take into account the sensitivity of the personal information

3.6 In general, unless otherwise specified by a customer or employee, i) a customer’s utilisation of Maple Leaf Foods’ products and services, correspondence with Maple Leaf Foods or participation in a contest or other promotional activity sponsored by Maple Leaf Foods or ii) an employee’s acceptance of and continued employment or benefits, constitutes consent for Maple Leaf Foods to collect, use and disclose personal information for all identified purposes.

3.7 A customer or employee, may withdraw its consent, where such consent is required by law, at any time, subject to legal or contractual restrictions and reasonable notice. Customers and employees may contact Maple Leaf Foods for more information regarding the implications of withdrawing consent.

Principle 4 — Limiting Collection of Personal Information

Maple Leaf Foods shall limit the collection of personal information to that which is necessary for the purposes identified by Maple Leaf Foods. Maple Leaf Foods shall collect personal information by fair and lawful means.

4.1 Maple Leaf Foods primarily collects personal information directly from its customers or employees.

4.2 Maple Leaf Foods may also collect personal information from other sources including credit bureaus, employers or personal references, or other third parties who represent that they have the right to disclose the information.

Principle 5 — Limiting Use, Disclosure, and Retention of Personal Information

Maple Leaf Foods shall not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, where such consent is required by law, or as otherwise permitted by law. Maple Leaf Foods shall retain personal information only as long as necessary for the fulfilment of those purposes.

5.1 In certain circumstances personal information can be collected, used or disclosed without the knowledge or consent of the individual. (See Principle 3.1)

5.2 In addition to the other identified purposes in Principles 2.1 and 5.3, Maple Leaf Foods may disclose a customer’s personal information to:
a) a person who in the reasonable judgement of Maple Leaf Foods is seeking the information as an agent of the customer;
b) a company or individual retained by Maple Leaf Foods to perform functions on its behalf, such as research or data processing;
c) a company or individual retained by a customer or employee who represents that it expressly is entitled to receive such customer’s or employee’s personal information, or in the reasonable opinion of Maple Leaf Foods implicitly is entitled to receive such customer’s or employee’s personal information;
d) a company or individual retained by Maple Leaf Foods for the evaluation, development, enhancement, marketing or provision of any of Maple Leaf Food’s products or services;
e) an agent utilised by Maple Leaf Foods to evaluate the customer’s creditworthiness or to collect the customer’s account;
f) a credit reporting agency;
g) a public authority or agent of a public authority, if in the reasonable judgement of Maple Leaf Foods, it appears that there is imminent danger to life or property which could be avoided or minimized by disclosure of the information;
h) a third party or parties, where the customer consents to such disclosure or disclosure is required by law; and
i) a financial institution on a confidential basis and solely in connection with the assignment of its right to receive payment, the provision of security or other financing arrangements.

5.3 In addition to the other identified purposes in Principles 2.1 and 5.2, Maple Leaf Foods may disclose personal information about its employees or former employees:
a) for personnel, pension and benefits administration;
b) in the context of providing references regarding current or former employees in response to requests from prospective employers; or
c) where disclosure is required by law.
d) We collect, use and disclose employee personal information to establish, manage, terminate, and administer the employment relationship;
i) To recruit, train, motivate, identify, manage and maintain a superior workforce.
ii) To foster harmonious employment relationships.
iii) To administer policies, including investigations.
iv) To manage and promote the Company’s businesses.
v) To administer compensation and benefits.
vi) To acquire and transfer businesses.
vii) To develop, manage and promote employee services, health, safety and security, and compliance with the Company’s requirements.

5.4 Only Maple Leaf Foods employees with a business need to know, or whose duties reasonably so require, are granted access to personal information about customers and employees.

5.5 Maple Leaf Foods shall keep personal information only as long as it remains necessary or relevant for proper retention procedures and the identified purposes or as required by law. Depending on the circumstances, where personal information has been used to make a decision about a customer or employee, Maple Leaf Foods shall retain, for a period of time that is reasonably sufficient to allow for access by the customer or employee, either the actual information, or the rationale for making the decision.

5.6 Maple Leaf Foods shall maintain reasonable guideline procedures for information and record retention and destruction, which apply to personal information that is no longer necessary or relevant for the identified purposes or required by law to be retained. Such information shall be destroyed, erased or made anonymous.

Principle 6 — Accuracy of Personal Information

Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

6.1 Personal information used by Maple Leaf Foods shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about a customer or employee.

6.2 Maple Leaf Foods shall update personal information about customers and employees as and when necessary to fulfil the identified purposes or upon notification by the individual.

Principle 7 — Security Safeguards

Maple Leaf Foods shall protect personal information by security safeguards appropriate to the sensitivity of the information.

7.1 Maple Leaf Foods shall utilise commercially reasonable efforts to protect personal information against such risks as loss or theft, unauthorized access, disclosure, copying, use, modification or destruction, through appropriate security measures. Maple Leaf Foods shall protect the information regardless of the format in which it is held.

7.2 Maple Leaf Foods shall protect personal information disclosed to third parties, including service providers, by contractual agreements stipulating the confidentiality of the information and the purposes for which it is to be used.

7.3 All of Maple Leaf Foods’ employees with access to personal information shall be required to respect the confidentiality of that information.

7.4 In Quebec, when collecting personal information an individual must be advised where that file will be kept, and the individual’s rights of access and rectification, who has access to it, the use and object of the file.

Principle 8 — Openness Concerning Policies and Practices

Maple Leaf Foods shall make readily available to customers and employees specific information about its policies and practices relating to the management of personal information.

8.1 Maple Leaf Foods shall make information about its policies and practices easy to understand, including:
a) the name or title and address of the person or persons accountable for Maple Leaf Foods’ compliance with the Maple Leaf Foods’ Privacy Policy and to whom inquiries or complaints can be forwarded;
b) the means of gaining access to a customer or employee’s own personal information held by Maple Leaf Foods; and
c) a description of the type of personal information held by Maple Leaf Foods, including a general account of its use.

Principle 9 — Customer and Employee Access to Personal Information

Maple Leaf Foods shall inform a customer or employee of the existence, use, and disclosure of his or her personal information upon written request and shall give the individual access to that information. A customer or employee shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

9.1 Upon written request, Maple Leaf Foods shall afford customers and employees a reasonable opportunity to review the personal information gathered by Maple Leaf Foods. Personal information shall be provided in understandable form within a reasonable time, and at a minimal or no cost to the individual.

9.2 Upon written request Maple Leaf Foods shall provide an account of the use and disclosure of personal information and, where reasonably possible, shall state the source of the information. In providing an account of disclosure, Maple Leaf Foods shall provide a list of organizations to which it may have disclosed personal information about the individual when it is not possible to provide an actual list.

9.3 In order to safeguard personal information, a customer or employee may be required to provide sufficient identification information to permit Maple Leaf Foods to account for the existence, use and disclosure of personal information and to authorize access to the individual’s file. Any such information shall be used only for this purpose.

9.4 Maple Leaf Foods shall promptly correct or complete any personal information concluded to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness shall be noted in the individual’s file. Where appropriate, Maple Leaf Foods shall transmit to third parties having access to the personal information in question any amended information or the existence of any unresolved differences.

9.5 Customers can obtain their personal information or seek access to their individual files by contacting a customer service representative or the Maple Leaf Foods Privacy Officer.

9.6 Employees can obtain access to their personal information or seek access to their personnel files by contacting their manager or Human Resources.

Principle 10 — Challenging Compliance

To the extent that their personal information is governed by applicable privacy legislation a customer or employee shall be able to address a challenge concerning compliance with the above principles to Maple Leaf Foods Privacy Officer.

10.1 Maple Leaf Foods shall maintain procedures for addressing and responding to all inquiries or complaints from its customers and employees about Maple Leaf Foods handling of personal information. Maple Leaf Foods shall inform its customers and employees who make inquiries or lodge complaints about the existence of these procedures as well as the availability of complaint procedures.

10.2 Maple Leaf Foods’ Privacy Officer shall inform any individual who has made a request pursuant to this principle, where such request is refused, in writing of such refusal, setting out his/her reasons for such refusal, as well as the availability of complaint procedures.

10.3 Maple Leaf Foods’ Privacy Officer may seek external or internal advice where appropriate before providing a final response to individual complaints.

10.4 Maple Leaf Foods shall investigate all complaints concerning compliance with the Maple Leaf Foods’ Privacy Policy. If a complaint is found to be justified, Maple Leaf Foods shall take appropriate measures to resolve the complaint including, if necessary, amending its policies and procedures. A customer or employee shall be informed of the outcome of the investigation regarding his or her complaint.

For more information on the Maple Leaf Foods’ privacy practices, contact: the Maple Leaf Foods’ Privacy Officer Jeffery Miller

(i) by mail at:
Maple Leaf Foods Inc.
16th Floor, 30 St. Clair Ave. West
Toronto, ON
M4V 3A2

(ii) by e-mail at: MillerJS@MapleLeaf.ca
(iii) by phone at (416) 926-2011; or
(iv) by fax at (416) 963-6125

For a copy of the Personal Information Protection and Electronic Documents Act, please access the Privacy Commissioner of Canada web site at www.privcom.gc.ca.

APPENDIX A

Additional Procedures for the Use, Collection and Disclosure of Personal Information in Quebec

In Quebec, the following additional guidelines must be followed when collecting/recording personal information:

(i) consent must be explicit, regardless of the sensitivity of the personal information;
(ii) information pertaining to the health and lifestyle of individuals must be collected on a form that can be separated from the rest of the application;
(iii) the first time personal information is collected, individuals are to be informed that the personal information will be recorded in a file that has been established for them, the purpose/object of the file, the use which will be made of it, the categories of persons who will have access to it, the place where it will be kept and the individual’s right of access to the personal information, and rectification;
(iv) unless the Company has specific consent to combine the personal information, and depending on the sensitivity of the issues, separate files must be established for the same individual if there are multiple purposes/objects for the personal information on record about the individual (e.g. separate files for different policies; separate files for different employment issues).