Can a student, in a FOIP request, gain access to a closed letter of which he or she is the subject of the information?
- Generally yes, since the letter would contain personal opinions about the student. In Order 200-029, the Information and Privacy Commissioner determined that letters of reference written in support of an application for admission to a graduate program should be disclosed because it affected a student's career opportunities, the student had asked the third parties to write the letters, the third parties may refuse the student's request, and that the student already knows who the third parties are because they asked the third parties to writer the letters in the first place. The Commissioner also found that the letters contained personal information about the student and the third parties but it would not be an unreasonable invasion of the third parties privacy to disclose their personal information contained in these letters. He also found that the letters did not constitute privileged information and the section 19 (confidential evaluations) could not be applied as all the criteria of that section was not met.
- However, under Section 19 of the Act, the Institute may refuse to disclose evaluative or opinion information collected for the purpose of conferring a benefit (e.g., a scholarship or other award) to an individual if the information was supplied in confidence. This is a narrow exception to disclosure of the information under the Act that would not apply to letters of reference in every situation.
Can the personal information of students be disclosed to potential employers who are making reference checks?
Only if, the student consents in writing to the disclosure of opinions about his/her grades, performance and suitability for the job. This consent may take the form of permission to contact the Institute or a named individual as a part of the student's application for employment. The institute should require a copy of the application or that part of it which authorizes the potential employer to seek information. Only the minimum required to meet the request of the employer should be released. For the convenience of NAIT's staff and students, a Student Record Reference Request form is available on NAIT's FOIP site, to obtain student consent for references to potential employers.
Can a student, in a FOIP request, gain access to evaluation forms completed by Employers who accept students on placement?
Generally this would be released to the student since the evaluation form would be part of their educational history and would be the personal information of the student. [Section 1(1)(n)(vii) and viii)] However, if the evaluation contained personal information about other people, this might have to be severed first.
Can a professional body or local or provincial apprenticeship committee require their clients to sign a blanket release so that they can have access to Institute records on students they sponsor or coordinate at the Institute?
The relationship between the student and his or her sponsor is not the concern of the Institute. The Institute has the discretion to disclose only information that the student has consented to release to the sponsor. (Section 40(1)(d))
Can a high school counsellor request information on the status of a high school student's application for admission to an institution?
Yes, if the student has actually been enrolled in the Institute. Disclosure of the fact that the student is enrolled could be disclosed since it would not be considered to be an unreasonable invasion of the student's personal privacy (Section 40(1)(b) and 17(2)(j)). However, it would be better for the student to obtain the information needed and provide it to the counsellor.
Can student grade lists be posted?
Not unless anonymity can be guaranteed. There are many ways to allow students to access their own grades while ensuring the personal privacy of the other students in a class. If a class is so small that grade holders could be easily identified despite any process to conceal identities, then grade lists should not be posted.
Can the Institute disclose information on former students/graduates?
Yes. Section 40(1)(b) permits disclosure of personal information if it would not be an unreasonable invasion of a third party's personal privacy. Under section 17(2)(j), it would not be considered an unreasonable invasion of a former student's personal privacy to disclose that he/she had been enrolled in the Institute or in a particular program; that he/she had received and honour or award (including a degree, diploma or certificate) granted by the Institute; that he/she had attended or participated in a public event or activity related to the Institute (e.g., an open house, sporting event or competition, fundraising activity or cultural event); or that he/she graduated from the Institute. However, this type of information should not be disclosed if the former student or graduate has specifically asked that the information not be disclosed (section 17(3)).
Can the Institute disclose the hometowns of its graduates to the media?
No. The Institute can disclose the names of graduates to the media. Under section 40(1)(b) and 17(2)(j), the disclosure of this information would not be considered an unreasonable invasion of the graduate's personal privacy. However, disclosing the names of their hometowns would require the graduates' consent. Consent for publication can be obtained at the time students apply for graduation.
Can the Registrar release a student's address/phone number to faculty member who is teaching the student or to a Counsellor at the same Institute?
This information would only be supplied on a "need to know" basis. Section 40(1)(h) allows for disclosure to an employee of the Institute if the information is necessary for the performance of his or her duties. The onus is on the employee to show why this information is necessary and a notation about the disclosure should be placed on the student's file.
Can an employee of the Institute ask a student for personal information about the student?
Yes, but only in accordance with sections 33(c) and 34(2) of the Act. The employee would have to show that the information relates directly to and is necessary for an operating program or activity of the Institute. He or she would also have to inform the student of this purpose and the use to which the information was going to be put.
Do the personal notes on an examination paper belong to the student who fills in the spaces between questions with their answers?
Personal information includes an individual's personal views or opinions, except if they are about someone else (section 1(n)(ix)). If the examination paper is going to be used in the near future and the Institute can document this fact, then the questions may be severed from the record before releasing the personal information to the student (section 4(1)(g) and section 26(b)).
Can students, in a FOIP request, access and review copies of their own previously completed examination papers?
The answers to examination questions are a part of the student's educational history and are personal information (section 1 (n)(vii)). However, if the examination paper is going to be used again in the near future and the Institute can document this fact, then the questions may be severed from the record before releasing the answers to the student (section 4(1)(g) and section 26(b)).
Can personal notes made during an interview with a student/staff member be withheld from a FOIP request?
Any information about a student or staff member is that person's personal information and, therefore, accessible under the Act (section 1(n)(viii) and 6(1)). This would not apply if the notes contained the interviewed person's opinions about a third party (section 1(n)(ix)). There may be occasions when information could be withheld if it would be harmful to someone's health or safety, harmful to law enforcement, or could be construed as advice to another official in the Institute. Because this could be a complex decision, the advice of the FOIP Coordinator should always be sought.
Are the anecdotal notes made by faculty members about students in a practicum portion of a program considered personal information?
Anecdotal notes and opinions about a person are that person's own personal information (section 1(n)(viii) and 6(1)). There may be occasions when information could be withheld if it would be harmful to someone's health or safety, harmful to law enforcement, or could be construed as advice to an official in the Institute. Because this could be a complex decision, the advice of the FOIP Coordinator should always be sought.
Can employees have access, via computer or hard copy, to student information?
Staff should only be accessing student information if they have a need to use that information as a part of their responsibilities. Section 40(1)(h) permits this type of disclosure. However, the fact that access to student information is available does not condone unauthorized access to that information. Also, staff need to ensure that there is an audit trail to follow regarding the disclosure or a notation made on the student's file.
Is it permissible to post in the halls of the Institute the students names and numbers of those who are "eligible to graduate" to ensure that students know whether or not they have successfully completed or are registered in all the courses required for graduation?
No, lists cannot be posted without the Institute being able to guarantee anonymity, unless students have previously consented to this use/disclosure.
Is the Institute obligated, in a FOIP request to release exam questions and answers? If so, when and under what circumstances?
The Institute must release questions unless it can show that they are going to be used on an examination or test in the near future (section 4(1)(g)). It may also refuse to disclose details of specific tests to be given if disclosure could reasonably be expected to prejudice the use of results of particular tests (section 26).
If written final exams have to be retained for one year after they are written, can students appeal their final grades up to one year after the exam is written?
No, the requirements to retain final exams for a period of one year is to allow an individual to examine this record and see the information used to make a decision about him of her. It does not affect the Institute's policy on appeal of grades.
What responsibility does the Institute have to ensure that the student has actually signed a consent to release personal information?
Generally, the Institute will assume the consent is valid. It should ask for a copy of the consent statement and identification of the person holding the consent, and should keep these on file with a notation of disclosure. If there is any reason to suspect that the consent may not be valid, the student should be contacted to confirm consent.
Can the finance department of the Institute disclose student information to a collection agency when a student has outstanding accounts with the Institute?
Section 40(1)(k) allows disclosure for the purpose of collecting a fine or debt owing by an individual to the Institute or to an assignee of the Institute. A notation of the disclosure should be placed on the accounts receivable record.
What information may be disclosed to the collection agency that is trying to collect a debt owed to the Institute?
The Institute should disclose only the information needed by the collection agency to do its job. This would likely mean name, home address and telephone number and, if the student is working, business address and telephone number, as well as the amount owing.
Is a verbal consent to use photographs for promotion adequate or should waivers be signed where students are identified or identifiable?
The Act makes no provision for verbal consent. If the program in which the student is enrolled or participating is one where such promotion is a reasonable use of a photograph, then this use should be stated in the disclosure statement provided at the time of collection (e.g., sports teams, music programs, fine arts programs). If the promotion is not a regular part of the program, specific written consent should be obtained prior to use of a photograph. For the convenience of NAIT's staff and students, a Photography/Media Consent and Release is available on NAITS FOIP site.
Can the Institute disclose a student's timetable?
No. A timetable contains information about a student's educational history (section 1(n)(vii)). It would also contain the student's name and likely the student's ID number. Consent should be obtained before release unless discretion can be exercised under section 40.
Can the Institute collect third party information form student's e.g., parents' date of birth/education?
Section 34 of the Act governs the collection of personal information. In order for the Institute to collect such information about third parties, it would have to be able to prove that the information was necessary to determine or verify the eligibility of the student to participate in a program of receive a benefit, service or product from the Institute (section 34(1)(k)). If it cannot do this, then the parents would have to authorize collection by the Institute from their son or daughter, or the information would have to be collected directly from the parents (e.g., credit cared information). The Institute should take care to collect only that information which is related directly to and necessary for student admission and attendance at the Institute.
Can the Institute disclose to a parent or spouse information about whether their child or spouse is enrolled as a student at the Institute?
Yes. Such disclosure would not be considered an unreasonable invasion of the student's personal privacy unless the student has specifically asked that this information not be disclosed (section 40(1)(b) and 17(2)(j)).
Can the Institute disclose to a parent or spouse information about the student's attendance, progress, grades, etc.?
No. This is personal information that should not be disclosed without the consent of the student or for any other discretionary purpose in accordance with section 40(1). A discretionary disclosure in accordance with section 40(1) should involve consultation with the FOIP Coordinator.
Can the registrar confirm that a student is registered in a specific program at the Institute in response to a third party inquiry?
Yes. Under section 40(1) and 1672)(j), this disclosure would not be seen as an unreasonable invasion of the student's privacy, provided the student has specifically not asked that this information not be disclosed.
Can the Registrar refuse to release an official transcript or diplomas to a student who owes money to the Institute for tuition fees, or for library books or equipment that has not been returned?
Yes. The Institute can refuse to issue an official transcript or official diploma unless the student settles the outstanding account but should issue a statement of grades to the student, instead. However, if the student submits a FOIP request for his/her own official transcript or diploma, the Institute would not be able to withhold this personal information on the basis that the student owes the Institute money. Section 6 provides an applicant with a right of access to any record in the custody of under the control of the Institute, subject to specific and narrow exceptions. The Institute would not issue an official transcript or diploma, only a photocopy of it.
Can the Institute share information about students with the student association?
Yes, but only to the extent that an agreement between the Institute and the Student Association requires information sharing (section 40(1)(e)). Sharing personal information without an agreement is likely not a consistent use of information collected from students by the Institute. However, the Institute can't enter or uphold an agreement that breaches and individual's privacy under the Act. Other information sharing should only be done with the consent of the student. Consent could be gathered at the time of registration.
Students often ask for copies of documents they submitted in support of their application. This could include high school, college, or university transcripts, medical information or reference letters. Does the Institute have to supply such copies?
Yes. A student has a right to the record even though in some cases the documents are ones they originally submitted. It is not automatic that they get the full record as the Institute has to ensure that it does not disclose personal information which would be an unreasonable invasion of the privacy of a third party or confidential information supplied directly to the Institute.
Is there a limit on how many additional copies of unofficial transcripts a student can ask for or can the Institute charge for re-issuing the statement?
The FOIP Act is in addition to, and does not replace existing informal procedures that the Institute has in place, for access to certain records (Section 3(a)). In most cases a student or former student request for a transcript is going to be made to the Registrar's office and should not require the formality of a FOIP request. The Institute's policy of charging a fee to defray photocopying costs for such requests should be followed. In the event of a formal FOIP request, fees and costs charged would be in accordance with the Regulations under the Act. In the event of multiple formal FOIP requests by the same individual for the same documents, there is provision under the Act to request authorization from the Privacy Commissioner to disregard one or more requests if they are frivolous or vexatious (Section 55).
How should a public body deal with telephone inquiries from students about information about their own record?
The Institute should satisfy itself of the identity of the person calling, perhaps through questions based on the student record the answer to which only the student is likely to know (e.g., courses taken, name of faculty, student number). Address and phone number are not sufficient proof of identity as they could easily be known by others. Whenever practical, the caller should be asked to submit their request in writing, with their signature included on the request.
In dealing with appeals, complaints and requests for refunds, information must sometimes be obtained on student's attendance and performance and student loan information. Can this collection continue under the Act?
Yes. Section 40(1)(h) permits disclosure to an employee of the Institute in order for that person to perform their duties. The disclosure should be limited to the information needed to do the job and only provided to the individual who has a need to know that information.
Can the Institute collect the SIN from students?
The only circumstance where a SIN should be collected is where the Institute has a reporting requirement to the Federal Government, or where legislation authorizes the collection for another purpose.
Will a request for an individual's own personal information always be a formal request under this act?
Requests for personal information cannot be categorized as routine release except in limited circumstances. This is because the records must be examined to ensure that they are relevant to the request and that personal information of other parties is severed if it would be an unreasonable invasion of their privacy and that, if there are records that may be withheld in NAIT's discretion, that discretion is considered. The Institute may organize its employee files so that they contain only personal information related to an individual, with no information that the public body may wish to exercise discretion over releasing such as confidential evaluation [Section 19]. It may also organize its student records so that a student has access to factual information about him or herself. In these circumstances, a policy can be used to routinely release this type of information. The FOIP Coordinator should be consulted in any case where routine release has not previously been authorized.
Is a public body required to sever libellous comments from letters of complaint before releasing them under FOIP?
If the applicant is the person about whom the comments are made, there is no authority for the Institute to sever such comments prior to releasing the record. However, the Institute may want to consider Section 17(4)(g) and other sub-sections in determining whether to release the name or other information that would identify the complainant. If the applicant is not the person about whom the comments are made, the information is the personal information of the individual the comments are about and may be severed in accordance with Section 17.
Can access to a record be denied under the Act because the requester already has a copy of the requested record?
No, the Act provides a general right of access and there is no provision for refusal, of access on the basis that the requester already has a copy of the record. Sometimes it is possible to negotiate with an applicant in these circumstances if it would reduce the cost of the request of the amount of information being released. If such requests become repetitious or systematic and legitimately interfere with the operations of the Institute or amount to an abuse of the right of access, the Commissioner can be asked to look at the case. The Commissioner has the power under Section 55 to grant permission to disregard such requests.
If high school grades in selected prerequisite subjects become part of the Institute record or transcript through the admission process, can they be released to students or to third parties at the student's request?
Yes, the student is entitled to access any personal information about him or herself that is held by the Institute, even if it is information the student supplied. Once the information is entered into the Institute records and is used to make a decision about admission, it must be retained for at least one year and is in the custody and control of the Institute. Release to third parties must be with the student's written consent specifying to whom the information can be disclosed to and how it may be used. FOIP Regulation, (Section 6)
What responsibility does the Institute have to ensure that the student has actually signed consent to release personal information?
Generally, the Institute will assume the consent is valid. It should ask for a copy of the consent statement and identification of the person holding the consent, and should keep these on file with a notation of disclosure. If there is any reason to suspect that the consent my not be valid, the student should be contacted to confirm consent.
How long must application forms for unsuccessful candidates or unsolicited application forms be kept?
If the Institute uses the application forms to make a decision about the individual, it must be retained for at least one year after the decision is made. If the form was used to make a decision about hiring, or not hiring, then it must be retained. Applications or resumes that come from unsolicited sources would only be retained if they were considered in the process of a personnel search. The Institute's transitory record policy would apply.
Can photographs be taken at the Institute?
Yes. At public events there is an expectation that photographs, may be taken by the public and this is not an unreasonable invasion of privacy. It's also expected that photos will be taken for preparing ID cards. Photos can be taken of anyone who gives their consent.