FOIP Frequently Asked Questions
What is a record?
A record is "information in any form and includes notes, images, audiovisual recordings, x-rays, books, documents, maps, drawings, photographs, letters, vouchers and papers, and any other information that is written, photographed, recorded, or stored in any manner, but does not include software or any mechanism that produced records."
Is a FOIP request the only way that individuals can access information about an institution or about themselves?
No. A formal FOIP request under the FOIP Act should be seen as the last resort for accessing information from an institution. The Act does not replace existing procedures for accessing personal information or other information that would normally be made available to the public or to an individual on request.
What is "custody" and "control"?
Custody refers to records in the physical possession of the public body (University of Lethbridge). A record is under the control of a public body when the public body has the authority to manage the record, including restricting, regulating, and administering its use, disclosure, or disposition.
What is personal information?
"Personal information" means recorded information about an identifiable individual, including the individual's name, home or business address, home or business telephone number, the individual's race, national or ethnic origin, colour, religious or political beliefs or associations, age, sex, marital or family status, identifying number, symbol or other particular assigned to the individual, fingerprints, other biometric information, blood type, genetic information or inheritable characteristics, information about the individual's health and health care history, including information about a physical or mental disability, information about the individual's educational, financial, employment, or criminal history, anyone elses opinions about the individual and the individual's personal views or opinions, except if they are about someone else.
How long do we have to retain the materials of a job applicant?
Any personal information in a record that was used to make a decision about that individual must be kept for a minimum of one year. After that time retention is based on Records Management requirements.
Can I share the personal information my department/unit has about an individual with another department/unit on campus?
Personal information about an individual may only be collected, used, and disclosed for the purpose expressed to that individual at the time of collection. Personal information may only be used for the original or a consistent purpose. Consistent purpose is one that has a direct and reasonable connection to the original purpose and that is necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body that uses that information (Section 41).
Is there any way I can share the personal information of an individual with another department/unit that is not for the original or a consistent purpose defined at the time of collection?
Yes. In these circumstances it is necessary to get written consent from the individual. The consent must include where the personal information will be disclosed, for what purpose, and for how long. The individual must sign the consent form and the area receiving it must retain it.
If I need proof of someone's birthdate, is it okay to take and retain a copy of that individual's driver's license or passport?
No. The FOIP Act requires that the only personal information that can be retained is specifically the information that is required for the job to be done. Driver's licenses, passports, and other identification usually contains more personal information than is required. If one needs to verify a birth date or other specific information, the individual may show you the document, but a copy cannot be retained.
Can I collect and/or disclose additional personal information from an individual "just in case" it is needed?No. The FOIP Act requires that only the minimum amount of personal information required to do a job can be collected and/or disclosed.
Can employee personal information be used for social purposes, such as to celebrate birthdays or extend invitations to social events?
Employee information cannot be used to celebrate birthdays or for non-work-related social purposes without employee consent, since the information was not collected by the employer for this purpose. If the social event is an operating program of the university, employee information could be used to send invitations.
Are the notes I write in my calendar or notebook subject to the FOIP Act?
The FOIP Act applies to all records in the custody or under the control of a public body (Section 4(1)). Any records made in the course of your duties and that relate to your business of the public body ("work product") are subject to, and accessible under, the Act. This includes, but is not limited to: email, notebooks, calendars, sticky notes...
Can an employee of the university ask a student for personal information about the student?
Yes, but only in accordance with sections 33(c) and 34(2) of the Act. The employee would have to show that the information relates directly to and is necessary for an operating program or activity of the university. S/he would also have to inform the student of this purpose and the use to which the information was going to be put.
Can the Registrar disclose a student's address/phone number to a faculty member who is teaching the student or to a Counsellor at the university?
Yes, but only on a "need to know" basis. Section 40(1)(h) allows for disclosure to an employee of the institution if the information is necessary for the performance of his or her duties. The onus is on the employee to show why the disclosure of this information is necessary and a notation about the disclosure should be placed on the student's file.
Can the university disclose information about the student's attendance, progress, grades, payment of fees, etc. to a parent, spouse, employer, or sponsor?
No. This is "educational history" which is personal information that should not be disclosed without the consent of the student unless it may be disclosed in accordance with Section 40(1).
Can the university disclose a student's timetable without consent?
No. A timetable is information about a student's educational history (section 1(n)(vii)). It would also contain the student's name and likely the student's ID number (section 1(n)(i) and (iv)). Consent should be obtained before disclosure unless direction can be exercised under section 40(1).
Can the university disclose to a parent or spouse information about whether their child or spouse is enrolled as a student at the university?
Yes. Such a disclosure would not be considered an unreasonable invasion of the student's personal privacy unless the student has asked that this information not be disclosed (Sections 40(1)(b) and 17(2)(j).)
Can the Registrar confirm that a student is registered in a specific program at the university in response to a third party inquiry?
Yes. Under sections 40(1)(b) and 17(2)(j), this disclosure would not be seen as an unreasonable invasion of the student's privacy, provided the student has not asked that this information not be revealed.
Can student grade lists be posted?
Not unless anonymity can be guaranteed. There are many ways to allow students to access their own grades while ensuring the personal privacy of other students in a class. If a class is so small that grade holders could easily be identified despite any process to conceal identities, then grade lists should not be posted.
Can Deans' Honour Lists be posted?
Yes, but only the student's name and program can be listed, and not other personal information including educational history (ie grades), ID number etc. (Section 17(2)(j)(iv) and 17(2)(j)(i)).
Can students involved in performing arts or competitive teams be photographed?
Students involved in performing arts or competitive teams perform or compete in public venues and it is reasonable to expect that photographs may be taken by spectators and by the university. Anyone may take photographs of students participating in a public event. These photographs may be disclosed for promotion of the univeristy or the university's activities.
Is it necessary to get consent from students for photographs or videos taken in the classroom?
Because classrooms are not public events or venues, and typically photographs/videos are not taken in them, is it necessary to gain written consent from each student prior to taking pictures or filming videos.