Freedom of Information and Protection of Privacy Act
FAQ for Employees
Protection of Privacy Issues | Access to Information Issues | Other Frequently Asked Questions | Forms | CNC Contacts
The Freedom of Information and Protection of Privacy (FOI/POP) Act gives individuals rights based on two principles:
- that records in the custody or control of public institutions are available to individuals (i.e. access); and
- that personal information held by public institutions is protected from unauthorized collection, use and disclosure (i.e. privacy).
The legislation affects the way employees deal with such records as exams, grades, evaluations, appeals, etc. The Act also requires institutions to establish policies and procedures for retention and disposal of files (see Retention Schedules in Human Resources).
This FAQ attempts to answer Frequently Asked Questions employees may have about the legislation. As there are two distinct aspects to the Act, the questions and answers have been arranged into issues of privacy and access to information.
What is a record?
Record is defined in Schedule 1 of the Act and includes books, documents, maps, drawings, photographs, letters, vouchers, papers and any other things on which information is recorded or stored by graphic, electronic, mechanical or other means. It does not include a computer program or any other mechanism that produces records.
What constitutes personal information?
The definition of personal information includes information such as the name, address, phone number, race, origin, colour, political or religious beliefs, age, sex, sexual orientation, marital or family status and any identifying number, symbol or other particular assigned to an individual. It also includes genetic information such as fingerprints or blood type, and personal history regarding health, education, finances, criminal records or employment. And finally, it includes anyone else’s recorded opinion about the individual and the individual’s recorded personal views or opinions, unless they are about someone else. Note that for employees working for public bodies, release of work-related contact information (such as name, office, phone) is not considered to be an unreasonable invasion of their privacy and is therefore releasable.
Protection of Privacy Issues
Can I post student grades using student I.D. numbers as identifiers?
It is recommended that faculty not post grades publicly (no matter how the results are 'coded'). Alternatives are: a) to relay the information individually; or b) to let students access their grades on the website in login-protected areas such as Blackboard or CNC Connect.
Can I leave marked student papers or lab reports in a box outside my office?
No. These must be given to students directly. If you do not return them to the student, you must retain them for one year (as per Section 35 of the Act and the Retention Schedule in Human Resources). Keep them in a secured drawer or filing cabinet to prevent unauthorized access.
Should I leave the book containing my students’ grades on my desk unattended?
While offices are considered the private domain of individual faculty members, it is good practice to leave grade books in a secured drawer or filing cabinet to prevent unauthorized collection of personal data.
Can I release any student information to parents, guardians, or funding sponsors?
No, not without consent. The College of New Caledonia, in adhering to the BC Freedom of Information and Protection of Privacy Act, is legally obligated to protect the right to privacy for its students. Unlike the K-12 school system which entitles parents/guardians to some student information, post-secondary educational institutions are prohibited from releasing any student information to parents/guardians unless the student provides written permission for the College to do so. This means that parents/guardians must obtain the student's signature on a CNC Information Waiver Form, where the student waives their right to privacy for clearly identified types of information and specifically names the parent or guardian to whom the information will be given.
In the event that a sponsoring agency is asking for student information the same process applies.
This process governs the release of all student information, including but not limited to: application and enrollment status, attendance, grades, grade point average, course registration, personal restrictions, complaints, student conduct and appeal processes, awards and other Student Awards & Financial Assistance information, Accessibility Services, Counselling services, Aboriginal Resource Centre services, and Wellness Centre services.
When dealing with an emergency (e.g. severe illness or death), or requests from legal authorities, please contact the Registrar or Director of Student Services at the Prince George campus, or Regional Directors at the regional campuses. They are responsible for handling such matters.
Do reference checks required by potential student employers require student’s consent?
Reference checks must have consent from the student prior to release of this type of personal information (see sample student references release form). Students are entitled to copies of these references, upon request. Note that the Registrar's office does not keep references on file for students and will only release (by consent) confirmation of graduation and dates of attendance.
Can I store personal information collected on behalf of the College at any place other than CNC?
Do I need to concern myself with personal information that I am required to send via fax or email?
The concern for protecting personal privacy extends to information that is faxed or emailed. As a rule, highly sensitive, personal data should never be faxed or emailed, unless it can be sent to a fax machine that can store the document in a “Confidential Mailbox” at the receiver’s end, or emailed with a Message Setting of "Private or Confidential." If at all possible, personal information should be sent by courier or mail; however, if time is of the essence, please ensure that the appropriate party is waiting to accept the personal information at the receiving end.
What privacy issues do I need to consider when posting to a webpage or publishing photos or videos?
Seek permission before publishing names, phone numbers, email addresses or personal photos of individuals (and honour any later requests to remove them). CNC uses a standard photo release form for photos of individuals (see photo/video release form). If you are posting or publishing student work, get written permission. If you are videotaping a presentation for public use, obtain a release from the presenter (see sample release form) and, if audience members will be shown, allow people to choose to opt out. Posting information about children under the age of 19 is not advisable; written consent of parents or guardians is required.
What privacy issues do I need to consider in the case of lecture recording?
There is an accommodation for students who have a documented disability and have a need to record lectures. They must make arrangements with Accessibility Services for this, and sign a Recording of Lectures Agreement Form which is presented to the instructor. In terms of student privacy, they agree on the form to turn off the recording device during any student discussion points (since personal information may be disclosed during the discussion and the identity of the student disclosing the information may be revealed). The privacy issue is one of many that are considered, in dealing with the question of recording lectures in class, and instructors generally do not permit recording unless it is for a documented disability. If they do permit recording, the student should sign a General Recording of Lectures Agreement Form.
CNC Information Waiver Form
Sample Student References Release Form
Photo/Video Release Form
Sample Presenter-Conference Release Form
Accessibility Services Recording of Lectures Form
General Recording of Lectures Agreement Form
Access to Information Issues
I made notes during a personal interview with a student/employee. Can I withhold this information from the interviewee?
Generally speaking - no. Remember that the interview information is about the individual and so is considered to be their personal information. There are only very limited and specific reasons why you would not release personal information to the individual. If in doubt, contact the Freedom of Information Officer.
Do students have access to anecdotal notes made by faculty in the clinical portion of a program?
Yes. These notes are opinions about students and, as such, are accessible by the student, if requested.
Are students entitled to view evaluation opinions of themselves made by selection committees for admissions or awards?
Yes. This is classified as personal data.
Do students have access to the personal evaluation forms completed by employers who accepted students in practicum or co-operative education placements?
Yes. Students have a right to see all personal information the institution has collected on them.
Do individuals have access to the notes I took during hiring interviews?
Under the FOI/POP Act, individuals have access to any information recorded about them, including notes taken during interviews. As a general rule, it is wise to be objective when recording information and not write down anecdotal comments, unless you are prepared to have them read by the interviewee(s) at some future date. Information available to interviewee(s) does not include tests, answer sheets or desired responses.
Do I have to release information contained in confidential files?
All confidential files should be considered releasable unless one of the exemptions under the FOI Act applies. Contact the Freedom of Information Officer, if you have any questions about exemptions relating to specific types of files.
Does CNC have to give personal data to lawyers or law enforcement agents?
Please refer such requests to the Freedom of Information Officer. The Act allows for exemptions for legitimate requests.
How does CNC collect personal information from students and/or employees?
The Act requires that forms used to collect personal information state the legal authority, specific purpose(s) for collection and usage of the data, as well as identify a person who can provide further information. The notice on forms should follow this general format:
Collection and Use of Information
The information on this form is collected under the legal authority of […usually the College and Institute Act]. The information provided will only be used to […state use]. If you have questions about the collection and use of this information, contact […name and/or position] at […phone number].
In the case of prospective students, information that is collected as part of the College's recruitment process is voluntarily supplied by the prospective student with the understanding that it will be used to assess the student's interests and qualifications for admission to the College.
Other Frequently Asked Questions
How long should I keep student exams on file?
At least one year. Section 31 of the Act states that “if a public body uses an individual’s personal information to make a decision that directly affects the individual, the public body must retain that information for at least one year after using it, so that the individual has a reasonable opportunity to obtain access to it.”
Does the Act require faculty to disclose their research projects?
There are provisions within the Act that recognize and protect the priority of publication. Note that if the project requires examination or use of student records or other personal information held by the College, the project must be carried out in a manner compliant with the Act. In these cases please consult with the Freedom of Information Officer.
How does the Act affect examination of personal information for research or statistical purposes?
Section 35 of the Act makes provision for research purposes and sets boundaries on disclosure to protect the privacy of the individual(s) concerned. Please contact the Freedom of Information Officer for information or copies of Section 35 and/or the complete Act.
How long should I keep personal information on file?
The Act states that institutions should keep personal information for a minimum of a year, depending on operational needs. Some records are subject to longer-term retention (see Retention Schedule in Human Resources). If in doubt, please contact the Freedom of Information Officer.
Can students access and receive copies of previous exam questions?
The Act does not apply to questions used on exams or tests. A suggested interpretation: if the examination is part of an exam database and the questions will be used again, then students may not have access to the exam questions, unless the instructor gives permission. If, however, the exam questions won’t be used again, then students may have access to the information.
Does the Act cover minutes of bargaining agents and/or union meetings?
No. The Act only covers public bodies – not associations or societies. If, however, such minutes are distributed to the library or members of administration, the documents become part of the institution’s public record holdings and, as such, may be subject to FOI/POP disclosure requirements.
Does the Act cover Student Union records?
As above. Student Union records that become part of the institution's public record holdings may be subject to FOI/POP disclosure requirements.
What about email?
Email stored in an employee's current mailbox qualifies as a record under the Act. Since most email is transitory in nature, it is a good idea to delete it regularly. Deleted email messages may be stored in backup records but the Commissioner has ruled that "under normal circumstances, there is no requirement on the part of a public body to search backup records, at least in the context of present technology" (Order 301) . Remember that if an FOI request comes in, all destruction of relevant material including email must stop immediately.
If I am responsible for a committee that disseminates minutes, are there any precautions that I should take before distributing the minutes?
Most minutes contain information that is of a public record nature and, therefore, there should be no concerns about distributing the minutes to others besides the committee members. If, however, the minutes deal with information of a personal nature – by naming or otherwise identifying individuals – precaution should be taken. The document should be marked “confidential” and should not be distributed to people other than committee members and, possibly, the individual(s) named in the minutes. Committee members should also take precaution when storing minutes that contain personal information. If a third party requests access to such minutes, please consult the Freedom of Information Officer.
Freedom of Information Contact - Library and Media Services Director (250) 562-2131 local 5298
Freedom of Information Officer - Human Resources Associate Director (250) 562-2131 local 5238
Right of Appeal
If access to records has been denied by CNC, a request to review the decision may be submitted in writing to:
Information and Privacy Commissioner
4th Floor, 1675 Douglas Street
Victoria, B.C. V8V 1X4
Tel: (250) 387-5629; Fax: (250) 387-1696
BC Information and Privacy Commissioner Website at http://www.oipc.bc.ca/ which includes a link to the Freedom of Information and Protection of Privacy Act.
BC Ministry of Technology, Innovation and Citizens' Services has posted detailed information on the Act, including policies, procedures and record retention best practices at http://www.cio.gov.bc.ca/cio/priv_leg/index.page
For a useful overview prepared by the Ministry for BC post-secondary institutions, see "Privacy and Access in British Columbia: B.C.'s Freedom of Information and Protection of Privacy Act (FOIPPA)" (slide-pdf, 2014)