NAV CANADA Protection of Data and Information

Your browser is out of date. Please consider using a different browser to ensure full functionality of the NAV CANADA website.

Sensitivity classification levels

Low
Data and information at this level can generally be made public with minimal implications for NAV CANADA. It is often informational in nature and there are no limitations on distribution inside or outside of NAV CANADA.

Moderate
Data and information at this level is intended for use within NAV CANADA and in the normal course of business with external partners (after a Non-Disclosure Agreement (NDA) is in place or under a contract or agreement).

High
Data and information at this level is on a need-to-know basis and may be subject to safeguards and handling practices to ensure its protection. It may include personal information.

Sharing externally is not permitted unless bound by contract or agreement and/or following a review by the Privacy Office Open a new window(if related to personal information).

What we deem to be Personal Information

As defined in our Privacy NoticeOpen a new window, Personal Information (PI) means any information about an identifiable individual including, but not limited to, name, contact information (address, telephone number, cell or personal phone number or email), date of birth, account numbers or details, such as payment details, log-in data, etc. Information about or received from individuals and/or third-party service providers should be presumed to be personal information unless the contrary is clear.

By virtue of the applicable privacy legislation, personal information does not include job title, job description or business contact information, such as the information disclosed on a business card, including business phone and email address.
This information can be in any form including paper, electronic, audio, video or biometric, such as voiceprints, photographs, and signatures. This information can also include information collected through digital activities, such as device model, browser type and IP address.

NAV CANADA protects personal information in accordance with applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA). These laws establish requirements for accountability, safeguarding, authorised use, disclosure, retention, and secure disposal of personal information.

What will I see as a recipient?

You will see a "NAV CANADA [Public/Proprietary/etc.]" label associated with an email or file. For emails, the label will display underneath the email subject line. For Office files, the label may appear in multiple locations based on what label is selected and your current Office version.

Emails with additional protections

In addition to a M365 Sensitivity Label, you may be sent an email with additional protections applied, based on how sensitive the sender has deemed the contents to be. Protections may include things like encryption, and restrictions on your ability to forward or print. 

If you receive a protected email message sent to your M365 account, the message should open like any other message. If you're using a different email account or program (e.g., Gmail, iCloud, yahoo, etc.), the email may redirect you to a secure portal to view the message.

Safeguards and handling practices

NAV CANADA protects data and information by applying safeguards and handling practices appropriate to its classification level.

This non-exhaustive list outlines the minimum safeguards for protecting NAV CANADA data and information classified as NAV CANADA Proprietary, NAV CANADA External Collaboration, or NAV CANADA Restricted (PI and NPI):

shared following the principle of “least privilege”;
used only for the authorised and intended purpose for which it was shared, and not for any secondary or unrelated purpose;
protected at rest with strong access controls, physical or electronic, that detect and prevent unauthorized access;
protected in transit using secure networks or with controls such as encryption;
not published or posted on any website or otherwise made publicly available without prior authorization; and
promptly and securely destroyed when no longer required for the intended purpose.

In addition, external providers and stakeholders must promptly report any suspected or confirmed privacy or security incident involving NAV CANADA data or information to their NAV CANADA contact, in accordance with contractual obligations.

Where NAV CANADA data and information is processed, stored, or accessed by third parties or in jurisdictions outside of Canada, applicable contractual and security safeguards apply.

The information set out on this page is for informational purposes only and does not supersede or modify any requirements or obligations that are set out in a contract between NAV CANADA and another party, including, without limitation, any specific requirements for the handling of NAV CANADA data and information by external providers and stakeholders. In the event of any conflict or inconsistency between the information on this page and any language in a contract, the contractual language will prevail.

NAV CANADA reserves the right to modify the information on this page at any time.

Questions or concerns related to the handling of personal information may be directed to the NAV CANADA Privacy Office.