Freedom of Information and Protection of Privacy Act

Presentation by Mark Grady

Vancouver Island University

June 13, 2012

The purposes of this Act are to make public bodies more accountable to the public andto protect personal privacy by

(a) giving the public a right of access to records,

(b) giving individuals a right of access to, and a right to request correction of, personal information, about themselves

(c) specifying limited exceptions to the rights of access,

(d) preventing the unauthorized collection, use or disclosure of personal information by public bodies, and

(e) providing for an independent review of decisions made under this Act.

FIPPA does not apply to

Teaching materials or research information of faculty members, teaching assistants, research assistants or other persons teaching or carrying out research at a post-secondary educational body**

A record of a question that is to be used on an examination or test

Material placed in the archives of a public body

Responding to FIPPA access requests

Duty to assist applicants and to respond openly, accurately and completely

30 business days to respond to the request

Must provide a written response confirming the reasons for refusing access to all or part of the records and the exception(s) to disclosure on which the refusal is based;

Mandatory exceptions to disclosure

Third party personal information where disclosure would be an unreasonable invasion of a third party’s personal privacy.

Confidential third party business information where its disclosure would significantly harm a third party’s business interests.

Discretionary exceptions to disclosure

Disclosure of information that would reveal advice or recommendations developed by or for the university.

Disclosure of information that could reasonably be expected to harm the university’s financial or economic interests.

Disclosure of information that is subject to solicitor client privilege

Common access requests received by universities Media requests for employees’ salary and travel expenses information

Unsuccessful job applicants or service providers

Disciplined or dismissed employees seek investigation and decision information

Employees who disagree with decisions about other employees or students

Students disciplined or expelled from the university

Contracts with service providers/companies to provide services

Lessons learned from FIPPA access requests:

Record information in an objective, professional manner;

Avoid adding information about your personal life in business emails;

Retain records for appropriate time periods;

Destroy records at the end of established retention periods and outdated drafts as soon as possible

Conduct a reasonable search for responsive records

FIPPA privacy protection obligations and requirements

A pernicious yet enduring myth is that privacy matters only to those who have something illegal or wrong to hide. Most of us have nothing to hide, yet still attach great value to our individual privacy. Privacy matters because we all have the right to maintain a private life, separate and apart from our public life. We negotiate our identity in the world and choose to share pieces of ourselves with those we trust. David Loukidelis, former B.C. Information and Privacy Commissioner, March 2008Under FIPPA, all VIU staff members, service providers or contractors and volunteers have an obligation to protect personal information contained in records in the university’s custody or under its control.

A best practice is to treat other people’s personal information as if it were your own information.

The privacy (data or personal information) protection minimum standards or requirements in BC’s FIPPA are based on ten internationally accepted fair information practices.

Collection

A key principle – if you don’t need it, don’t collect it – reduce the risk of unauthorized access, use or disclosure by minimizing the type and amount of personal information you collect

What authority do you need for collection? The most relevant authorities are:Authority under an Act - The University Act - necessary to provide educational programs and related services

Relates directly to and is necessary for a VIU program or activity

With the individual’s informed consent**

Reducing the risk that an individual will be a victim of domestic violence**

Method of Collection

You must collect personal information directly from the individual the information is about unless

–the individual authorizes another method or source of collection

– necessary for medical treatment of the affected individual who is incapable of providing consent

–collection is for the purpose determining suitability for an honorary degree, scholarship, prize, bursary or similar honours or awards

– collecting a debt or fine

– information is about an employee and the collection is necessary for managing or terminating the employment relationship**

Notification

What information must be included in the notification?

the purpose of collecting it; the legal authority for collecting it, and; the name and contact information for a VIU employee who can answer the individual’s questions about the collection

When is notification not required?

when the information is about a law enforcement matter; the information is collected by observation at a public event at which the individual voluntarily appears**; where it is reasonable to expect that the notification to an employee would compromise the availability or accuracy of the information, or an investigation or a proceeding related to the individual’s employment**

Accuracy and Completeness

If an individual's personal information

will be used by or on behalf of the public body to make a decision that directly affects the individual,

the public body must make every reasonable effort to ensure that the personal information is accurate and complete.

Right to request correction

An applicant who believes there is an error or omission in his or her personal information may request the head of the public body that has the information in its custody or under its control to correct the information.

Retention

Personal information must be retained for at least one year if the information has been used to make a decision that directly affects the individual

Security

FIPPA requires public bodies to protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal

“Reasonable security arrangements" are those that a fair, rational person would think were appropriate to the sensitivity of the information and to the medium in which it is stored, transmitted, handled, or transferred.

January, 2012 University of Victoria break-in and privacy breach

Prohibition on storage of personal information , or access to it from, outside Canada

Use of Personal Information

A public body may use personal information for:

the purpose for which that information was obtained or compiled (and the purpose should have been confirmed in collection notification);

a use consistent with that purpose (the new use has a reasonable and direct connection to the original purpose and is necessary for performing the university’s statutory duties or for operating a university program or activity);

a different use where the individual has provided written consent to that use for specific information,

Disclosure of Personal Information

FIPPA authorities that allow universities to disclose personal information

where the individual consents to the disclosure of specific information

where its disclosure is not considered an unreasonable invasion of privacy in response to a FIPPA access request

under an enactment of BC or Canada that authorizes or requires disclosure to contact the next of kin or a friend of an injured, ill or deceased individual

for research purposes where there is a FIPPA research agreement between the university and the researcher

To a “law enforcement” agency or body (policing, or investigations or proceedings that lead or could lead to a penalty or sanction being imposed)

Procedure for Resolving Privacy Complaints

Attempt to resolve at the university – address concerns, investigate complaints, provide written decision

If unsuccessful, notify the individual of the Information and Privacy Commissioner’s role to independently review university privacy decisions of practices

Privacy Impact Assessment

Until last fall, only provincial government ministries were required to conduct a privacy impact assessment to determine if a current or proposed enactment, system, project or program meets FOIPOP’s privacy requirements.

With the November 2011 amendments, the university now has the same obligation for conducting a privacy impact assessment and notifying the Commissioner where the proposed systems, projects, programs or activities concerns a "common or integrated program or activity" or a "data-linking initiative"**