Policy

Weyerhaeuser is committed to protecting employee personal information in accordance with applicable privacy laws.

This policy outlines the practices that Weyerhaeuser follows in protecting and managing personal information collected, used, or disclosed by Weyerhaeuser in relation to its current and former employees in Canada.

Expectations

Definition of Personal Information

For the purposes of this policy, the term "personal information" means information about an identifiable individual in Canada, but does not include information that is publicly available, such as information in an online directory or business contact information (information that would appear on a business card) when used for business-related purposes.

Collection of Employee Personal Information

Weyerhaeuser collects employee personal information, which may include the following:

  • identification details such as
  • current and previous names, gender, date of birth, social insurance numbers, personal health numbers, marital and family status, nationality, citizenship, passport information, work permit information, veteran, minority, and disability status, and home and emergency contact information;
  • job application and background check information (e.g., resumes, references, and academic, criminal, credit, and work history);
  • professional affiliations, status, and membership information;
  • driving records and driver’s license information;
  • benefits and pension enrollment and maintenance information, including spouse and dependent names, addresses, and birthdates;
  • tax and banking information;
  • compensation information;
  • performance behaviours and appraisals;
  • medical information relating to fitness for work, leaves of absences, disability benefit eligibility, and accommodation needs;
  • results of drug, alcohol, or other substance testing;
  • information collected through Weyerhaeuser's security and workplace video surveillance systems in accordance with Weyerhaeuser's Electronic Surveillance Policy, Canada ;
  • information collected through Weyerhaeuser’s electronic devices (such as laptops), network, and information technology systems, pursuant to Weyerhaeuser's Computer and Network Use Policy; and
  • any other employee personal information necessary for purposes of managing the employment relationship.

Purposes for Collection, Use and Disclosure of Personal Information

Weyerhaeuser collects employee personal information necessary to the employment relationship, including for the following purposes:

  • to evaluate and select prospective employees;
  • to establish the employment relationship, including verification of identity, references, work history, and qualifications;
  • to set up and administer payroll, benefits, EAP, pension, life insurance, compensation, and other similar plans;
  • to maintain and manage the employment relationship including:
  • the assessment and management of performance, qualifications, fitness for duty, and personal and professional development;
  • the provision of training; and
  • compliance with and enforcement of Weyerhaeuser's policies and procedures;
  • to process work-related claims (e.g., workers' compensation and disability claims);
  • to determine and meet accommodation needs;
  • to maintain the security of and appropriate use of Weyerhaeuser worksites, property, and information technology systems;
  • to investigate workplace incidents;
  • to report safety incidents and for safety-related training;
  • to investigate security breaches or misuse of computer equipment and systems;
  • to protect the safety of employees and third parties;
  • for conflict-of-interest reporting;
  • to compile workplace directories;
  • for use in making travel arrangements and for other travel-related purposes;
  • to plan social activities and events;
  • in relation to business transactions, including participating in or conducting due diligence activities associated with a purchase, sale, or reorganization;
  • to provide employment and income verification;
  • to terminate the employment relationship;
  • to provide Record of Employment information to Service Canada for employment insurance eligibility and to provide compensation information to Canada Revenue Agency for tax and other purposes;
  • to manage the post-employment relationship;
  • in the event of an emergency; and
  • to meet legal and regulatory requirements.


Employees are deemed to have consented to Weyerhaeuser’s collection, use, and disclosure of their personal information in accordance with this Employee Privacy Policy.

Weyerhaeuser will ask employees for express consent when (a) the collection, use, or disclosure of personal information falls outside the scope of the information or purposes specified above or (b) the collection, use or disclosure without express consent is not permitted or is required by law.

Weyerhaeuser will use and disclose personal information only for the purposes for which the information was collected, except as authorized by law. Weyerhaeuser will notify and, if required, obtain consent for use and disclosure of employee personal information which falls outside the purposes for which the information was originally collected.

Transfer of Personal Information

Weyerhaeuser discloses a limited amount of personal employee information to certain third parties and service providers located within and outside of Canada, including benefits providers and administrators, actuaries, auditors, consultants, payroll administrators, financial institutions, and government agencies. Weyerhaeuser engages such service providers for the employment-related purposes outlined above, including managing payroll, benefits, group insurance, and pension-plan services. Because of this, personal employee information may be subject to transfer outside of Canada (including the United States and India). Weyerhaeuser requires that such service providers maintain privacy protections that are comparable to those outlined in this policy.

Weyerhaeuser also routinely transfers employee personal information among its affiliates located in Canada and the United States, including Weyerhaeuser Company, Weyerhaeuser Company Limited, and Weyerhaeuser NR Company, for the purposes described above. This policy applies to such affiliates.

Please note that employee personal information is subject to the legal requirements of the jurisdiction in which it is located, and may be accessible by courts, law enforcement, and national security authorities of that jurisdiction.

Protection of Personal Information

Weyerhaeuser protects personal information in a manner appropriate for the sensitivity of the information. Weyerhaeuser employs adequate administrative, physical, and technical safeguards and makes reasonable efforts to prevent loss or misuse of, unauthorized disclosure, copying, modification, disposal, or destruction of, or unauthorized access to, personal information.

Weyerhaeuser stores employee personal information in its human resources records and on human resources management and payroll software systems. Access to personal information stored on such systems is limited to individuals on a need-to-know basis.

Weyerhaeuser retains employee personal information for as long as is reasonable to fulfil the purposes for which the information was collected or for business purposes or legal requirements. When destruction is appropriate, Weyerhaeuser will employ appropriate measures to destroy personal information, which may include shredding paper records or permanently deleting electronic records.

Employee Access to and Correction of Personal Information

Employees may access their own personal information in Weyerhaeuser's custody or control, except in specific circumstances. Applicable privacy law may prohibit access to information that contains personal information about another individual or confidential business information. In some cases where exceptions to access apply, Weyerhaeuser may redact or withhold that excepted information and provide the remainder of the record.

Weyerhaeuser makes reasonable efforts to ensure that personal information is accurate and complete. If an employee is aware of an error in personal information maintained about him or her, the employee should promptly inform Weyerhaeuser and Weyerhaeuser will make reasonable efforts to correct it whenever possible.

Employees may make a request for access or correction to their personal information by email to privacyofficercanada@weyerhaeuser.com or by writing to Weyerhaeuser Company Limited, c/o Privacy Officer, 1140 West Pender Street Suite 440, Vancouver, BC V6E 4G1. Sufficient information must be provided in the request to allow Weyerhaeuser to identify the information or correction the individual is seeking.

Weyerhaeuser will endeavour to respond to an employee’s request for information within the timeframe required by applicable privacy laws and will indicate whether the employee is entitled to access the information. If Weyerhaeuser refuses an employee’s request for access to his or her personal information, Weyerhaeuser will provide reasons for the refusal and the name of the person who can answer questions about the request, and will advise of the right to have the decision reviewed by the applicable provincial Privacy Commissioner.

Employee Compliance

All employees must review and comply with this policy. In addition to any other related duties regarding confidentiality that each employee may have, Weyerhaeuser expects that employees will only access, collect, use, and disclose personal information in compliance with applicable privacy laws and Weyerhaeuser's policies and guidelines, including this policy, the Personal Information Privacy Protection Policy, and the Electronic Surveillance Policy, Canada. For clarity:

  • any personal information that an employee collects must be limited to what is reasonably necessary to accomplish Weyerhaeuser’s legitimate business purposes or as outlined in Weyerhaeuser's policies and guidelines, or as is necessary to comply with applicable law;
  • employees are expected to make reasonable efforts to ensure that any personal information they access, collect, use, or disclose on behalf of Weyerhaeuser is accurate and complete;
  • employees are permitted to access, collect, use, or disclose personal information only on a need to know basis (i.e. when the information relates to and is necessary to perform their job duties);
  • employees are explicitly prohibited from accessing, collecting, using, or disclosing personal information for any reason unrelated to their job duties or which is not in compliance with Weyerhaeuser's policies and guidelines or the law;
  • employees whose job duties involve collecting, accessing, using, or disclosing protected health information (e.g. employees who help administer Weyerhaeuser-sponsored health plan coverage) are permitted only to do so in accordance with applicable laws, this policy and Weyerhaeuser's HIPAA privacy and security policies;
  • employees must handle and store personal information with security safeguards appropriate to the sensitivity of the information;
  • employees must properly dispose of records or media that contain personal information, including by erasing, shredding, or otherwise modifying to make unreadable or undecipherable, when such records are no longer needed to fulfill the legitimate business purpose for which they were collected or to satisfy a legal requirement, in compliance with applicable laws and Weyerhaeuser’s Records and Information Management Policy  and record retention policies;
  • employees must participate in company-provided training relating to the access, collection, use, and disclosure of personal information; and
  • if any employee becomes aware of any actual or potential unauthorized collection, use, disclosure, access, modification, or loss of personal information, he or she must immediately report it to Weyerhaeuser's Privacy Officer at privacyofficercanada@weyerhaeuser.com.