Introduction

The purpose of this privacy guidance is to explain how to conduct surveys in compliance with the Freedom of Information and Protection of Privacy Act (FIPPA).
This privacy guidance is intended to assist UBC staff and faculty members to understand their obligations under FIPPA. It is not intended to be a substitute for legal advice. If you have specific questions about FIPPA, contact the Office of the University Counsel.

When Online Surveys Raise Privacy Issues

It is preferable for you to conduct surveys anonymously. If you are not collecting any personal information, there are no privacy issues.
If, however, you are using a survey to request personal information, then you must comply with FIPPA’s requirements around collection, storage, use, disclosure, and security of personal information. These requirements are summarized below.

“Personal information” is defined as recorded information about an identifiable individual other than business contact information. Here are examples of personal information that is typically collected in surveys:
1. personal identifiers (including the IP address of the respondent’s computer);
2. personal contact information such as residential address, phone number, and email address;
3. information about ethnicity, religion, political views or income level; and
4. personal opinions.

For more guidance about how to identify personal information, see the privacy guidance “What is Personal Information?”
Collection of personal information through surveys is normally authorized under one of the following sections of FIPPA:
1. Section 26(c): the information relates directly to and is necessary for a program or activity of UBC;
2. Section 26(e): the information is necessary for the purposes of planning or evaluating a program or activity of UBC.

You may only collect personal information under sections 26(c) and (e) if the collection is “necessary” for a program or activity or for the purposes of planning or evaluating a program or activity. To determine whether the collection is “necessary”, you should consider three factors:
1. How sensitive is the personal information you are collecting?
2. Do you have legitimate business purposes for the collection?
3. Are you only collecting the personal information that is minimally required to achieve your legitimate business purposes?
Sections 26(c) and 26(e) provide UBC with authority to conduct surveys of students and alumni for a variety of purposes connected with the planning or evaluation of programs or activities. Keep in mind, however, that all of the students’ information, including their names and contact information, is considered to be personal information and must be protected under FIPPA.
Sections 26(c) and 26(e) also authorize UBC to conduct surveys of faculty and staff members. Normally, they should be contacted at their workplace (through their work email address or phone number) rather than at home. When conducting surveys of faculty and staff, you must always be clear about whether you are requesting information from them in their official or personal capacities. Information they provide in their personal capacities (e.g. information about their commuting behaviour) is personal information and must be protected under FIPPA.

Your survey must contain a “privacy notification” that explains your legal authority for collecting the personal information, why you are collecting it, and the contact information of somebody who can provide more information about the collection.

For more guidance about the wording of privacy notifications, refer to the privacy guidance “Collecting Personal Information”.

If you hire a consultant or polling firm to conduct a survey that collects personal information, you must ensure that a contract is in place between the service provider and UBC that specifies how the personal information is to be protected, secured, and destroyed when it is no longer required. For more information about privacy language in contracts, contact Legal Counsel in the Office of the University Counsel.
All consultants or polling firms conducting surveys on your behalf must clearly identify themselves to the survey participants as a representative of UBC and must provide a full and complete privacy notification, as described above.

FIPPA restricts UBC and its service providers from storing sensitive personal information outside Canada, unless a Privacy Impact Assessment (PIA) has been conducted that considers the risks of that foreign storage. To initiate a PIA, contact Privacy Matters: https://privacymatters.ubc.ca/privacy-impact-assessment.
It is highly recommended that you use a Canadian-based tool for online surveys. For example, both UBC IT and Edudata Canada (a research unit at UBC) offer online survey tools that are based in Canada.

Personal information collected in surveys should only be used for the purpose it was collected and should only be reported in an aggregated, non-identifying manner. Care should be taken to ensure that individual survey participants are not re-identifiable. Normally, this means that detailed information must be aggregated to a less detailed level to avoid the risk of identification.

FIPPA requires UBC to make reasonable security arrangements to protect personal information from unauthorized access, collection, use, disclosure or disposal.¹ Survey results containing information about identifiable individuals must be stored in a secure location.
If you are storing large volumes of personal information on network drives, encryption is highly recommended. If you are storing personal information on mobile devices, such as laptops and USB keys (flash drives), encryption is mandatory. More information about encryption may be found in the UBC Information Security Standards.

¹ Section 30 of FIPPA