Access to Information and Protection of Privacy

Date

March 20, 1997

Revision Date

Number

I 10.04

Revision No.

Purpose
 
To provide policies which are consistent with the University Act and the Freedom of Information and Protection of Privacy Act regarding access to general information and the protection of personal information held by the University about students, employees or persons whose contractual arrangements are administered by the University and where the University has custody or control of the information.

Responsibility

The following University officers are responsible for ensuring the implementation of this policy:


  • President
  • Deans
  • Vice-Presidents
  • Registrar
  • Executive Directors
  • University Librarian

Employees are responsible for maintaining the confidentiality of general and personal information according to the policies below and they are required to ensure that personal information is maintained in a secure environment. Violations of this policy may result in disciplinary penalties being imposed.

 

Employees should consult, as needed, the University's Information and Privacy Coordinator about the disclosure of confidential and personal information, including information to be released under Sections 22(4) or 33 of the Freedom of Information and Protection of Privacy Act.

The University's Freedom of Information and Protection of Privacy Committee is responsible for ensuring that the policies outlined in Section 13.2 of this policy are consistent with the Freedom of Information and Protection of Privacy Act.

Scope

This policy applies to all employees of the University who have access to general and personal information.

Definitions

The terms below are those used in the Freedom of Information and Protection of Privacy Act. The definitions use examples from the university community to help illustrate their meaning. The following definitions describe the types of information which must not be disclosed to persons other than those who are authorized to have access:

Personal Information

means recorded information about an identifiable individual which includes, but is not limited to names, home addresses and telephone numbers, age, sex, marital or family status, identifying number, race, national or ethnic origin, colour, religious or political beliefs or associations, educational history, medical history, disabilities, blood type, employment history, financial history, criminal history, anyone else's opinions about an individual, an individual's personal views or opinions, and name, address and phone number of parent, guardian, spouse or next of kin.

 

Educational History

includes course grades, grade point average, academic status, graduation status, other institutions attended, admission status, course schedule and course registration status.

 

Financial History

includes information about beneficiaries, insurance, benefits and debts.

 

Employment History

includes personal recommendations or evaluations, character references or personnel evaluations, letters of discipline and reprimand and reasons for termination

 

Medical History

includes health care history relating to medical, psychiatric or psychological diagnosis, condition, treatment or evaluation.

 

Law Enforcement

includes disciplinary investigations or proceedings that lead or could lead to a penalty or sanction being imposed and policing

Related Definitions

 

First Party

means the applicant (i.e. individual or organization) requesting access to information.

 

Second Party

means the University.

 

Third Party

means the person or organization whom the information concerns other than the applicant.

Policy

A. Access to Information

  1. The University supports the public's right of access to information and the individual's right of access to, and the right to request correction of, personal information about themselves.

     

  2. The University will provide routine access to information informally upon request, or actively disseminate information, using existing procedures.

     

  3. A person has a right of access to any record in the custody or under the control of the University, including a record containing personal information about the applicant.

     

  4. The right of access does not extend to information excepted from disclosure under Sections 12 to 22 of the Freedom of Information and Protection of Privacy Act, but if that information can reasonably be severed from a record an applicant has the right of access to the remainder of the record.

     

  5. The right of access to a record may be subject to the payment of any fee required according to University policy or practice for informal access requests and for a formal access request under Section 75 of the Freedom of Information and Protection of Privacy Act.

B. Protection of Personal Privacy

Collection


  1. The University will collect personal information about students, employees, graduates or others as provided for under Sections 26 and 27 of the Freedom of Information and Protection of Privacy Act, ensuring at all times that it uses an appropriate notice and method of collection.


Accuracy of Factual Information


  1. The University will make every reasonable effort to ensure that the personal information it uses is accurate and complete. Upon request by an individual to whom information relates, the University will correct or annotate the information with a correction when documentary evidence, satisfactory to the University, is provided to substantiate the correction.


Protection


  1. The University will protect personal information by making reasonable security arrangements to prevent the risk of unauthorized collection, access, use, disclosure or disposal of personal information.


Retention and Disposition


  1. The University will retain for at least one year an individual's personal information when it is used to make a decision that directly affects the individual and thereafter the University will dispose of personal information only with a Records Retention Schedule and Disposal Authority approved and signed by the University Archivist/Information and Privacy Coordinator.


Use


  1. The University will use personal information only:

    1. for the purpose for which that information was obtained or compiled;
    2. for a use consistent with that purpose;
    3. with the written consent of the individual; or
    4. for the purpose for which that information was disclosed to the University.


Disclosure


  1. The University will not disclose personal information about students or employees to any third party, unless it is otherwise provided for under Sections 22(4) or 33 of the Freedom of Information and Protection of Privacy Act (see Appendices A and B for those circumstances when personal information can be disclosed).

Procedures

Access to General Information

    12.2 For informal requests, access will be provided according to those procedures used in the department or office that has custody of the information.

    12.3 For formal requests, access will be provided according to those procedures coordinated by the University's Information and Privacy Coordinator.

Access to Third Party Personal Information by Employees

    13.2 Access will be administered according to those specific policies and procedures which may be established from time to time by the University to apply to the personal information of specific groups of individuals, such as students, faculty, staff, graduates or others.

Access to Third Party Personal Information About Employees

    14.1 Access to the following information about employees will be provided routinely pursuant to Section 22(4)(e) of the Act. Requests will be handled by the Office of the Vice-President, Academic regarding employees in the SFUFA bargaining unit, and by the Office of the Vice-President, Finance and Administration regarding all others:

    14.2 Access to information about expenses incurred by employees while travelling at the expense of the University will be provided routinely pursuant to Section 22(4)(h) of the Act. Requests will be handled by Financial Services.  

    1. Position
    2. Functions
    3. Remuneration

Access for Research, Statistical, Archival or Historical Purposes

    15. Access to personal information for research, statistical, archival or historical purposes will be allowed under conditions specified in Sections 35 and 36 of the Freedom of Information and Protection of Privacy Act. These include the written agreement of the researcher to comply with all relevant sections of the Freedom of Information and Protection of Privacy Act and with the University's policies and procedures relating to the protection of personal information.

Appendix A

Freedom of Information and Protection of Privacy Act

S.B.C. 1992, Chapter 61, as amended by S.B.C. 1993, Chapter 46

22(4) A disclosure of personal information is not an unreasonable invasion of a third party's personal privacy if


  1. the third party has, in writing, consented to or requested the disclosure,
  2. there are compelling circumstances affecting anyone's health or safety and notice of disclosure is mailed to the last known address of the third party,
  3. an enactment of British Columbia or Canada authorizes the disclosure,
  4. the disclosure is for a research or statistical purpose and is in accordance with section 35,
  5. the information is about the third party's position, functions or remuneration as an officer, employee or member of the University,
  6. the disclosure reveals financial and other details of a contract to supply goods or services to the University,
  7. public access to the information is provided under the Financial Information Act,
  8. the information is about expenses incurred by the third party while travelling at the expense of the University,
  9. the disclosure reveals details of a licence, permit or other similar discretionary benefit granted to the third party by the University, not including personal information supplied in support of the application for the benefit, or
  10. the disclosure reveals details of a discretionary benefit of a financial nature granted to the third party by the University, not including personal information that is supplied in support of the application for the benefit or is referred to in subsection 22(3)(c).
  11. Appendix B

    Freedom of Information and Protection of Privacy Act

    S.B.C. 1992, Chapter 61, as amended by S.B.C. 1993, Chapter 46

    33. The University may disclose personal information only


    1. in accordance with Part 2 of this Act (see section 22),
    2. if the individual the information is about has identified the information and consented, in the prescribed manner, to its disclosure,
    3. for the purpose for which it was obtained or compiled or for a use consistent with that purpose (see section 34),
    4. for the purpose of complying with an enactment of, or with a treaty, arrangement or agreement made under an enactment of, British Columbia or Canada,
    5. for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body with jurisdiction to compel the production of information,
    6. to an officer or employee of the University, if the information is necessary for the performance of the duties of, or for the protection of the health or safety of, the officer or employee,
    7. to the Attorney General for use in civil proceedings involving the government,
    8. to the Attorney General or a person referred to in section 37 of the Coroners Act, for the purposes of that Act,
    9. for the purpose of

      1. collecting a debt or fine owing by an individual to the government of British Columbia or to the University, or
      2. making a payment owing by the government of British Columbia or by the University to an individual,

    10. to the auditor general or any other prescribed person or body for audit purposes,
    11. to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem,
    12. to a representative of the bargaining agent who has been authorized in writing by the employee, whom the information is about, to make an inquiry,
    13. to the archives of the University, for archival purposes,
    14. to a public body or a law enforcement agency in Canada to assist in an investigation

      1. undertaken with a view to a law enforcement proceeding, or
      2. from which a law enforcement proceeding is likely to result,

    15. if the public body is a law enforcement agency and the information is disclosed

      1. to another law enforcement agency in Canada, or
      2. to a law enforcement agency in a foreign country under an arrangement, written agreement, treaty or legislative authority,

    16. if the head of the University determines that compelling circumstances exist that affect anyone's health or safety and if notice of disclosure is mailed to the last known address of the individual the information is about,
    17. so that the next of kin or a friend of an injured, ill or deceased individual may be contacted, or
    18. in accordance with sections 35 and 36.