2000-7-1 Confidentiality & Privacy of Information & Records

Policy

Confidentiality and Privacy

1. Information collected in student records (e.g. academic, discipline, financial, health, financial aid), in employee records and concerning persons using Lambton College services will be used to administer the student programs, activities and services of the College, manage the Human Resources department functions and deliver employee benefits and services, and generally administer the College.
2. Information provided to the College by business and government partners, suppliers and other third parties will be used to achieve the business and other goals of the College, consistent with the purposes for which the information is provided to the College.
3. All Lambton employees are responsible and accountable for maintaining the confidentiality and privacy of all records containing personal or confidential information, and for compliance with this policy when working with and having access to confidential records and personal information.
4. The College will use organizational processes and security protocols to ensure the integrity, privacy and confidentiality of the information in its records. The administrator, at the director or dean level, of the department that stores or uses the personal information and confidential records shall be responsible and accountable for the implementation and operation of processes and protocols that ensure the confidentiality of the records and information, and the privacy of the individuals. Specifically, but not exhaustively, responsibility for the privacy and confidentiality of student and financial aid records rests with the Registrar; for student health records, with the Associate Vice-President, Student Success; for financial records, with the Director of Finance; for employee records with the Director, Human Resources; for video surveillance recordings and other security related information with the Director of Facilities; and for classroom and laboratory student recordings with the relevant Dean.
5. Records and personal information concerning a student or employee will be used or disclosed only by those College employees, consultants or agents authorized to access those records or information for the conduct of College business, or as otherwise permitted or required by law or as authorized in this Policy.
6. Personal information or confidential records may be released only by the administrator responsible for the information and records as described above, or their designate. (e.g.  Only the Registrar may release information concerning students and their registration status or grades.) Where access to information is sought under FIPPA or PHIPA, the responsible administrator shall refer the matter to the designated position of the College.
7. Public Information concerning a student consists of: name of graduate, credential granted, date credential was granted, awards given and date the awards were given. Public Information concerning an employee arises from the employment role and consists of name, title, work address, work telephone number and work e-mail address.
8. The posting of any student grade or evaluation result by student name, student number or any other identifying symbol or code is strictly prohibited unless the posting is in a manner that does not lead to the identification of the individual.
9. A list of student names or the student directory will not be released except for use within the College, for example, to administer Student Administrative Council (SAC) elections.
10. The College will publish an information statement (see appendix A) describing its collection and use of student information and provide an avenue for students to seek additional information or note concerns regarding the gathering and use of the information.
11. The College may use video surveillance cameras on College property for the purpose of ensuring the safety and security of students, employees and campus visitors, and the security of College facilities and property.  The video records will be considered confidential and subject to the provisions of FIPPA and this policy.
12. Student and employee information and records will be retained as described in the Records Retention (1000-1-3) policy.

Student or Employee Access to Information

1. Subject to sections 17 through 24 of this policy, students or employees, upon written request and verification of identification, shall:
   1. be given access to their own files;
   2. be able to release all or part of the file to a third-party; or
   3. be able to request that the file be held with no release allowed.
2. Students or employees may have access to their own files, but may not alter or remove any of the contents.
3. Where individuals are granted access to their own files and disagree with the content of the record or file, they may, in writing, request the correction of the information or require that a statement of disagreement be attached to the information where correction is refused. Any statement of disagreement will then be considered a part of the file.
4. The College may hold back the release of a student's record, to the student or a third-party, if there are debts outstanding to the College.

Exemptions to Access to Information

1. Access to information in the custody or control of the College is governed by the provisions of FIPPA and PHIPA. When considering any request to access personal information or confidential information, the College will apply the statutory exemptions as appropriate.
2. The following are illustrative of some of the relevant exemptions:
   1. The disclosure could be reasonably expected to interfere with a law enforcement or legal matter, or an ongoing internal investigation;
   2. The disclosure would reveal information received in confidence from another government body or its agencies;
   3. The information was supplied in confidence, and is evaluative or opinion material compiled for such purposes as assessing the teaching materials or research of an individual, determining suitability or eligibility of qualifications for admission to a program, determining suitability for an honour or award, or determining suitability, eligibility or qualifications for the awarding of contracts or employment or other benefits, and where the disclosure would reveal the identity of the source who furnished information to the College in circumstances where it was explicitly stated or may reasonably have been assumed that the identity of the source would be held in confidence;
   4. The disclosure would reveal a trade secret, scientific or labour relations information of the College or a third party;
   5. The disclosure would reveal information relating to specific tests or testing procedures or techniques that are to be used for educational purpose; or
   6. The record or information is subject to solicitor-client privilege.

Disclosure of Information to a Third-Party

1. The College may use and disclose personal information and confidential information for the purposes for which it was collected or generated or for any consistent purpose. The College shall identify the primary purposes at the time of the collection or generation of the information.
2. The College may provide personal information to an organization that is providing a service to students or employees on behalf of the College – e.g. health insurance or other benefits – or is conducting a mandated or required activity – e.g. Graduate Satisfaction Survey.
3. In addition, the College may disclose personal information or confidential information with the specific, written consent of the individual or third party, or as otherwise permitted or required under FIPPA, PHIPA or any other applicable law.  Specific guidance on the disclosure of personal information is provided below.
4. Confidential personal information and records will be released posthumously only with the authorization of the President.
5. The health, safety or security of an individual or the College may take precedence over the confidentiality of information and records, and the privacy of an individual. In those instances in which there is a serious threat of danger to a person or persons or the institution, the College may disclose confidential information about a student or employee to an appropriate health or security agency or immediate family member. See the Disclosure of Information in the Event of Emergency (4000-3-5) policy.
6. In the case of video surveillance data, access, based on an identified need, may be granted to appropriate College personnel by the Director, Facilities Management. Release of video surveillance data to outside agencies, including police, must be authorized by the Director, Facilities Management, and shall be consistent with the terms of this policy.

Parents

1. For any student who is at least 16 years of age, personal information or records will be released to a parent only with specific, written consent of the student.

Sponsoring or Funding Agencies

1. The College will provide personal information or records concerning a student on the request of the agency only with the written authorization of the student, or as otherwise required by law.

Police and Courts

1. In the event that a student record or personal information is subpoenaed by a court (or any other decision-maker with the authority to compel information) on behalf of the student, a certified copy of the requested student record or information will be offered.  Should the record or information be subpoenaed by a party other than the student, or a party representing the student, a certified copy of the record or information will be provided to the judge (or other decision-maker) alone, with an explanation of the College's reluctance to release a private record or information without student authorization.
2. Personal information or other confidential information may be released to the police or other law enforcement agency only where such disclosure is to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result. If the police request information under a warrant or other court order, disclosure shall be limited to the terms of the warrant.

Government Agents

1. Confidential personal information and records will be released to government agents or agencies as required by law, and then only that information specifically requested will be released.  Where the requested disclosure is not required by law, specific, written consent of the individual must be obtained.

Researchers

1. Requests from external researchers undertaking statistical studies for personal information and records must be approved by the President, or designate, under conditions that protect the individual's privacy, guarantee the anonymity of the data collected and are consistent with the ruling of the Research Ethics Board. Only that information specifically requested will be released. Any disclosure of personal information for research purposes shall comply with all applicable statutes and regulations.

Fundraising

1. The College may disclose alumni information to the Lambton College Foundation and the subsidiary Lambton College Alumni Association for the purposes of fundraising activities. The College shall ensure that the disclosure of alumni information for fundraising purposes is limited to that information reasonably necessary for the fundraising purposes. The College shall also ensure, by written agreement that the Foundation complies with the requirements of section 42 of FIPPA, as they relate to fundraising activities.

Breach of Confidentiality or Privacy

1. Breach of confidentiality or privacy includes any unauthorized or inappropriate access to, or disclosure of, personal information or other confidential information or records, whether such access or disclosure is intentional or inadvertent.
2. Any employee who becomes aware of a breach of confidentiality or privacy must immediately inform the administrator (director, dean, Registrar) responsible for the records.
3. The responsible administrator shall immediately inform their Vice-President of the breach and, subsequently, steps taken to address the breach and to prevent further breaches. These actions shall be taken under the direction of the Vice-President and senior leadership of the College.
4. As directed by senior leadership, the responsible administrator shall inform the individual(s) affected by the breach of the incident, including information of any measures being undertaken to address the breach.
5. The responsible administrator shall develop and implement process or protocols to prevent any further breaches, and shall consult with other responsible administrators in determining the appropriate processes and protocols to put in place.

Definitions

Student

includes persons currently registered as full-time or part-time students and, where relevant, may be construed to include past registrants including graduates, and applicants who have not, or do not, attain registered student status.

Record

means any records of information however recorded (in print, on film, electronically, etc.) and includes, but is not limited to, the following: a student file, an employee file, correspondence, e-mail, memorandum, a drawing, photograph, a sound recording, and a video recording.

Personal Information

is information about an identifiable individual. It includes, but is not limited to, the following: gender, age, sexual orientation, marital or family status, race, national or ethnic origin, information related to employment, information related to educational history (except for Public Information as defined in this policy), information related to medical, psychiatric, or psychological history, prognosis, condition, treatment or evaluation, social insurance number (SIN), student number, home address, telephone number, personal opinions of or about an individual, correspondence from, to or about an individual that is implicitly or explicitly of a private nature.

Confidential information

refers to information that is not generally known to the public and which, by its nature and content, ought to be kept private, and includes personal information of identifiable individuals as well as confidential information provided to the College by third parties.

Confidentiality

refers to the keeping private and the non-disclosure of confidential information of any kind, and requires that confidential information not be disclosed, shared or disseminated in any manner other than in the conduct of College business or as permitted in this policy.

Privacy

refers to the access to the records of individuals and requires that those records and the information contained therein be viewed or accessed only by an employee, consultant or agent of the College for whom there is a valid need, on the occasion of the accessing, in order to conduct the College business required of them.