Technology Use Policy

Purpose:

The Mycological Society of Toronto owns, maintains and manages Information Technology (IT) resources to support the educational, instructional, and administrative activities of the MST.

This policy sets out the acceptable and responsible use of MST IT Resources, in order to protect the MST and its Members, and to ensure the appropriate use of IT Resources and Information Assets in compliance with privacy law and in accordance with MST policies.

This policy applies to all MST Staff’s use of IT Resources. The use of personally-owned equipment that involves the use of IT Resources is also covered by this Policy. This Policy does not affect the rights of MST Staff to their intellectual property stored or transmitted using IT Resources.

Definitions:

References:

• Mission and Values of the MST
• Anti-Harassment Policy
• Code of Conduct Policy
• Membership Policy
• Bylaws: 2.1 - 2.7 (Membership)
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• Canada's Anti-Spam Legislation (CASL)
  
  

Policy:

1. Authorized Use
   1. MST Staff will:
      
      1. Use IT Resources for which the MST has given express authorization only for intended purpose(s);
      2. Take all reasonable steps to avoid compromising the confidentiality, integrity, and availability of IT Resources;
      3. Abide by applicable laws and regulations;
      4. Abide by applicable MST policies, and;
      5. Respect the rights and privacy of other MST Members and those outside of the MST community.
   2. MST Staff who fail to comply with this Policy will be subject to one or more of the consequences listed in Section 9.
   3. The MST reserves the right to limit or restrict access to IT Resources by MST Staff based on:
      
      1. institutional priorities;
      2. financial considerations;
      3. one or more violations of this Policy or other MST policies;
      4. contractual agreements; or
      5. provincial or federal laws.
2. Limitations on Personal Use by MST Staff
   1. MST Staff are permitted to use IT Resources for occasional and limited personal use and consistently with this policy.
   2. The viewing or distribution of harassing, defamatory, discriminatory, pornographic or hateful material and messages by MST Staff using IT Resources is prohibited.
   3. MST Staff should not store or transmit personal information using the MST’s network, equipment, or accounts.
3. Use of MST Email
   1. MST-provided email accounts must not be considered secure or private.
   2. MST Staff will not use their personal, educational or employer email accounts for MST correspondence.
   3. MST Staff will not use MST-provided email accounts for personal communication or when subscribing to personal mailing lists.
   4. Automatic forwarding of MST email to domains not controlled by the MST is prohibited.
   5. Sending email from MST-provided email accounts via mail servers in domains not controlled by the MST is prohibited.
   6. Email transmission of Members’ Personal Information to an external email account is prohibited.
   7. Email is primarily a transactional communication tool and should not be used as a system of record or for long-term storage of files. When appropriate or necessary, emails and/or email attachments should be transitioned to appropriate MST electronic storage systems.
   8. MST Staff will not delete email necessary for business continuity, either during or upon termination of their term of volunteering and/or employment, including but not limited to:
      
      1. legal correspondence;
      2. proprietary or confidential information, and;
      3. compliance-related correspondence.
4. Security and Ownership Rights
   1. MST Staff are required to protect confidential information regarding members and affairs of the MST, including but not limited to:
      1. identity of or details about members, except as governed by the Privacy Policy;
      2. financial information and records;
      3. contracts, and;
      4. technical information such as databases, login credentials, passwords and software license keys.
   2. Login credentials and passwords shall not be shared with any person without the explicit approval of the Board of Directors.
   3. It is the duty of the Technical Director to change passwords as necessary, and to disseminate login credentials and passwords in a secure manner to authorized persons.
   4. The Technical Director, the President and the Vice-President shall have access to current login credentials and passwords for all MST Shared Accounts and related tools and services at all times
   5. Login credentials and passwords for Shared Accounts (i.e. accounts to which multiple MST Staff require access) may only be changed by the Technical Director, the President, or the Vice-President.
   6. If login credentials and/or passwords for a Shared Account is changed, the new login credentials and/or passwords must be immediately stored in the MST’s password escrow in accordance with current procedure.
   7. Staff have the right to reset or request a reset of passwords for accounts to which they are the only individual requiring access, including their:
      1. email account;
      2. document repository account;
      3. wiki account;
      4. password escrow account, and;
      5. Slack account.
   8. MST Staff who have deleted files from one IT Resource, such as a computer hard drive are responsible for managing copies that may continue to exist in or on other IT Resources, such as shared drives. MST Staff are responsible for ensuring file management and disposition of Information Assets in accordance with MST policies and procedures.
   9. Information Assets created or received outside of IT Resources, such as on a personal smartphone or computer must be stored on MST-controlled IT Resources as soon as possible to ensure continuity during a Staff member’s absence.
5. Privacy
   1. IT Resources are exclusively the property of the MST. The MST respects MST Members’ reasonable privacy expectations but MST Members will not have an expectation of complete privacy when using the MST’s IT Resources.
   2. MST Members’ privacy rights may be superseded by the MST’s right to protect:
      1. the integrity of its IT Resources;
      2. the rights of other MST Members; or
      3. the MST’s property.
   3. The MST reserves the right to monitor and log usage of its IT Resources.
   4. The MST also reserves the right to examine and preserve material stored on or transmitted through its IT Resources at its sole discretion. Examples of situations where the MST may exercise this right include but are not limited to situations where the MST suspects:
      1. this Policy has been violated;
      2. any other MST policy has been violated;
      3. any federal or provincial law has been violated; or
      4. examination is necessary to protect the integrity of its resources.
   5. The MST will not normally access an MST Member’s Electronically-Stored Information without consent except for certain limited and specific circumstances, including but not limited to:
      1. investigations regarding security, illegal activity, or activity that may contravene the MST's policies and procedures;
      2. compassionate circumstances, as permitted by law;
      3. where necessary to carry out urgent operational requirements during an volunteer's absence when alternative arrangements have not been made; and
      4. compliance with law or legal obligations.
   6. Authorized MST Staff or service providers under contract with the MST, who operate and support IT Resources, may access Electronically-Stored Information without notice to MST Members in order:
      1. to address emergency problems;
      2. to perform routine system maintenance; or
      3. for any other purpose required to maintain the integrity, security and availability of the IT Resources.
   7. In the process of monitoring IT Resources, the MST will:
      1. use all reasonable efforts to limit access to MST Members’ Electronically-Stored Information; and
      2. not disclose or otherwise use any MST Members’ Electronically-Stored Information that has been accessed, except in accordance with the applicable MST policies, procedures and guidelines, and as permitted or required by law.
   8. If the MST is required to disclose a MST Member’s Electronically-Stored Information, in accordance with the law, such disclosure will be reviewed and approved by the Board of Directors, prior to the release of the Electronically-Stored Information.
6. Specific Violations
   1. Unauthorized Use. Violations of Section 1.1.a include, but are not limited to:
      1. using IT Resources without specific authorization where specific authorization is required;
      2. using another person’s electronic identity, password or log-in credentials for IT Resources;
      3. accessing files, data or processes without authorization;
      4. using IT Resources to hide a persons’ actual identity;
      5. using IT Resources to interfere with other systems or persons;
      6. using IT Resources to harass or stalk another person or entity;
      7. sending threats, “hoax” messages, chain letters, or phishing;
      8. intercepting, monitoring, or retrieving any network communication without authorization; or
      9. circumventing or attempting to circumvent security mechanisms.
   2. Breach of Confidentiality, Integrity and Availability of IT Resources. Violations of Section 1.1.b include, but are not limited to:
      1. obtaining or using someone else’s password or other authentication credentials for IT Resources;
      2. disclosing a personal password or other authentication credentials for IT Resources;
      3. permitting other MST Staff to access or use their account(s) provided by the MST;
      4. propagating computer viruses, worms, Trojan Horses, malware or any other malicious code;
      5. preventing others from accessing an authorized service;
      6. spreading material that supports bulk mail, junk mail, or spamming;
      7. degrading or attempting to degrade performance or deny service; or
      8. corrupting, altering, destroying, or misusing data or information.
   3. Unlawful Use. Violations of Section 1.1.c include, but are not limited to, using or attempting to use IT Resources to:
      1. pirate software;
      2. access material that is illegal, or that advocates or facilitates illegal acts;
      3. download, install, use, stream, or distribute unlawfully or illegally obtained media (e.g., software, music, movies);
      4. override, remove or pause any security software installed on IT Resources by the MST or at its direction;
      5. access technology that is considered a controlled good under federal law on an unencrypted connection;
      6. commit criminal harassment, hate crimes, or libel and defamation;
      7. commit theft or fraud; or
      8. violate child pornography criminal laws.
   4. Breach of MST policies. Violations of Section 1.1.d include, but are not limited to, using or attempting to use IT Resources to:
      1. engage in discrimination and harassment, including making threats, stalking, or distributing malicious material; or
      2. direct others to breach any provision of this policy.
   5. Breach of Privacy. Violations of Section 1.1.e include, but are not limited to:
      
      1. accessing, attempting to access, or copying another person’s Electronically-Stored Information without authorization; or:
      2. divulging sensitive personal data to which certain MST Staff have access concerning Members and/or Staff without a valid and lawful administrative reason.
7. Reporting
   1. MST Staff are responsible for guarding against misuse or abuse of IT Resources.
   2. MST Staff will promptly report any known or suspected misuse of IT Resources or violation of this Policy to the Technical Director.
8. Investigation
   1. Reports of conduct by MST Staff in contravention of this Policy will be addressed by the following means:
      • Harassment, violence or discrimination will be investigated under the Anti-Harassment Policy.
      • Other violations can be addressed under the Code of Conduct Policy.
   2. Reports of conduct by MST Staff in contravention of this Policy not addressed by another policy will be addressed by the Board of Directors.
9. Consequences
   1. Members who violate this Policy or any other MST policy may be subject to disciplinary action up to and including, but not limited to:
      
      1. suspension of access to some or all IT Resources;
      2. termination of membership in accordance with the Membership Policy and Bylaws; and
      3. legal action.
10. Relevant Legislation
    1. Canada’s Anti-Spam Legislation (CASL)
    2. Personal Information Protection and Electronic Documents Act (PIPEDA)