Introduction
- The purpose of this privacy guidance is to explain how to collect personal information in accordance with the Freedom of Information and Protection of Privacy Act (FIPPA).
- This privacy guidance is intended to assist UBC staff and faculty members to understand their obligations under FIPPA. It is not a substitute for legal advice. If you have questions about FIPPA, contact the Office of the University Counsel.
When Personal Information May Be Collected
- Under FIPPA, you do not need an individual’s consent to collect their personal information, but you do need to have authority under FIPPA to do so. Here is a list of the most common authorities for collection:1
| FIPPA Section | Authority to Collect Personal Information |
| 26(a) | The collection of the information is expressly authorized under an Act |
| 26(b) | The information is collected for the purposes of law enforcement |
| 26(c) | The information relates directly to and is necessary for a program or activity of UBC |
| 26(e) | The information is necessary for the purposes of planning or evaluating a program or activity of UBC |
| 26(f) | The information is necessary for the purpose of reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur |
| 26(g) | The information is collected by observation at a presentation, ceremony, performance, sports meet or similar event at which the individual voluntarily appears, and that is open to the public |
- At UBC, we almost always collect personal information because it “relates directly to and is necessary for a program or activity” of UBC (section 26(c) of FIPPA). To show that the collection is “necessary”, we must be prepared to demonstrate that the information is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection.
- If you are not sure whether you are authorized to collect personal information in a given situation, you should consult with Legal Counsel in the Office of the University Counsel.
How Personal Information May Be Collected
Overview
- There are four ways to collect personal information. Collection may be informed (with the knowledge of the individual) or uninformed (without that individual’s knowledge). Collection may also be direct (from the individual the information is about) or indirect (from a third party). Here are examples of the different methods of collection:
| Informed | Uninformed | |
Direct | Example: asking a job applicant to fill out an application form | Example: accessing a student’s account without her knowledge and reading her personal emails |
| Indirect | Example: calling a job applicant’s references to checkhis credentials | Example: interviewing an employee’s coworkers without his knowledge to determine his suitability for an award |
Informed Collection of Personal Information
- Under FIPPA, it is preferable for you to inform individuals that you are collecting their personal information. You must tell the individual your legal authority to request the information, how you will use the information, and who can answer questions about the collection.2 This is called a “privacy notification”. Here is a template for privacy notifications:
| Privacy Notification: Your personal information is collected under the authority of section ___(A)___ of the Freedom of Information and Protection of Privacy Act (FIPPA) [and ___(B)___ ]. This information will be used for ___(C)___ . Questions about the collection of this information may be directed to ___(D)___ . | |
KEY: | |
(A) | In this space, enter the paragraph of section 26 of FIPPA that provides the general legal authority for collecting the personal information. At UBC, we generally use the authority of section 26(c)(the information relates directly to and is necessary for an operating program or activity of the public body). |
(B) | In this space, where applicable, enter any Federal or Provincial laws other than FIPPA that provide specific legal authority for collecting the personal information. |
(C) | In this space, enter the purpose for collecting the personal information. If the personal information will be made available to the public, you should also state that here. |
(D) | In this space, enter the title, business address and business telephone number of an officer or employee of UBC who can answer the individual's questions about the collection of personal information. In most cases, this should be an employee within the relevant program area. As an alternative to entering the title, address and phone number, it is acceptable to provide an email address. |
- Where possible, the privacy notification should be in writing and should be prominently displayed on the form or webpage you are using to collect personal information. It is not necessary for individuals to sign or initial the privacy notification.
- It is preferable to collect personal information directly from the individual the information is about. If you are collecting information indirectly (eg. conducting reference checks of job applicant) then your privacy notification should clearly explain how you will be collecting the information.
Uninformed Collection of Personal Information
- Uninformed collection of personal information is only permissible under exceptional circumstances. For example:
| FIPPA Section | Authority for Uninformed Collection of Personal Information |
| 27(1)(a.1) | The collection of the information is necessary for the medical treatment of an individual and it is not possible to collect the information directly from the individual |
| 27(1)(c)(i) | The information is collected for the purpose of determining suitability for an honour or award including an honorary degree, scholarship, prize or bursary |
| 27(1)(c)(ii) | The information is collected for the purpose of a proceeding before a court or a judicial or quasi-judicial tribunal |
| 27(1)(c)(iii) | The information is collected for the purpose of collecting a debt or fine or making a payment |
| 27(1)(c)(iv) | The information is collected for the purpose of law enforcement |
| 27(1)(c)(v) | The information is collected for the purpose of reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur |
27(1)(f) |
|
| 27(3)(d) | The information is collected by observation at a presentation, ceremony, performance, sports meet or similar event at which the individual voluntarily appears, and that is open to the public |
- Before engaging in uninformed collection of personal information, you should consult with Legal Counsel in the Office of the University Counsel.