FOIP FAQs - Records Retention
How long should the Institute keep its paper/electronic records?
- There is no simple answer to this question. The Institute has established records retention and disposition schedules or a retention policy, guideline and procedure for its records, including electronic and transitory records.
- A records retention and disposition schedule is a document that identifies and describes records, and indicates the length of time they shall be retained as active before transfer to semi-active storage; the length of time they should be retained as semi-active prior to final disposition; and final disposition of the records.
- The FOIP Act allows the destruction of records in accordance with the Institute's records retention policies, guidelines and procedures.
- Under section 53(1)(a), the Commissioner has the power to conduct an investigation into how an institution is managing its records. Specifically, the Commissioner can check to make sure that an institution is following any policies, guidelines and procedures it has regarding the destruction of records.
- Post-secondary institutions are required by section 35 to keep personal information about an individual for at least one year if that personal information has been used by the institution to make a decision about the individual.
When applying for a posted position, is the information contained in the application submitted to Human Resources affected by the Act?
Yes, the application is being submitted in response to a request for applications. A decision will be made on whether to short list or interview the applicant based on the information contained in the application. When personal information is used to make a decision about an individual, the information must be retained for a period of at least one-year after using it, to allow the individual an opportunity to review the record and request corrections to it. (Section 35(b))
What are the limitations on researchers using Institute records?
Use of Institute records for research purposes is governed by Institute policy on research and data sharing. When records contain personal information that can identify individuals, they must be stripped of any personal identifiers or the researcher has to apply to the Institute for permission to use the records. The researcher will have to show that the research purpose cannot reasonably be accomplished unless the information is provided in individually identifiable form; that the record linkage will not be harmful to the individuals the information is about, and that the benefits to be gained are clearly in the public interest. The researcher will have to sign a research agreement under Section 42 of the Act.
What legal obligations exist regarding the keeping of records?
The FOIP Act does not prohibit the transfer, storage or destruction of records in accordance with the Institute's policies, guidelines and procedures as authorized by the Board of Governors. A Records Retention and Disposition Schedule will govern how long records have to be kept and the manner of disposition. Personal information that is used by the Institute to make a decision that directly affects the individual the information is about must be kept for at least one year after using it. However, NAIT's retention policy may dictate a longer retention period. (Section 35(b))
Can personal information collected on behalf of the Institute be permanently stored at a location other than the Institute?
Yes, the FOIP Act does not prohibit the transfer, storage or destruction of records in accordance with the Institute's policies, guidelines and procedures as authorized by the Board of Governors. Any record over which the Institute has control is subject to the Act, irrespective of where it is stored or who has actual physical custody of the record.
Is the Institute required to create a record in a different form than that which it currently has? e.g. information contained in several databases rather than as one record?
Yes, in some circumstances. When there is a formal FOIP request, Section 10(2) requires a public body to create a record when it can readily do so using existing hardware and software and technical expertise. This requirement is further limited by the requirement that fulfilling this obligation should not unreasonably interfere with the operations of the Institute. The Act applies only to existing records.