Introduction

1. The purpose of this Privacy Fact Sheet is to answer some common questions about the application of the Freedom of Information and Protection of Privacy Act (FIPPA) to UBC work email systems, such as FASmail. This Fact Sheet does not apply to email systems intended for personal use, such as the Student and Alumni Email System.
2. This Fact Sheet is intended to assist UBC staff and faculty members to understand their obligations under FIPPA. It is not a substitute for legal advice. If you have questions about FIPPA, contact the Office of the University Counsel.

Are Emails Subject to FIPPA?

3. FIPPA restricts how UBC collects, uses and discloses “personal information”, which is defined as recorded information about an identifiable individual other than business contact information. All information about students is personal information, but the names and work contact information of employees are not. For more information, see the Privacy Fact Sheet What is Personal Information?
4. When UBC work email systems are used to transmit personal information, this personal information is subject to the protection of privacy requirements of FIPPA.
5. In addition, FIPPA allows members of the public to request access to “records” held by UBC, subject to limited exceptions. Emails are considered to be records. Therefore, individuals should be aware that there is a possibility that work-related emails may be disclosed in response to an access request under FIPPA. For more information about access requests, see UBC’s Access and Privacy Webpage.

Are Email Addresses Confidential?

6. Work email addresses (e.g. john.smith@ubc.ca) are not confidential (because they are business contact information, which is public information). Many work email addresses are published on the directory on the UBC website.
7. The UBC email addresses of students and alumni (e.g. john.smith@student.ubc.ca and john.smith@alum.ubc.ca) are considered to be personal information, published on internal directories and may be used internally for UBC purposes.
8. Other personal email addresses are considered to be personal information and must not be shared with others without the recipient’s written consent.
9. When sending emails to multiple personal email addresses, you must not place student or personal email addresses in the “To” field because you will expose the email addresses to the other recipients. To hide the email addresses, you must place them in the “Bcc” (blind carbon copy) field.

Is Calendar Information Confidential?

10. For work accounts, free/busy information is not considered confidential, provided that no information about the appointment is visible. However, you must not disclose the contents of the calendar entries unless you are certain that they do not contain confidential or personal information.

Can I Include Personal Information in my Emails?

12. Emails sent from UBC work email accounts to external email accounts are not a confidential and secure method of communication. Therefore, you must exercise extreme caution when emailing personal information (and other information of a confidential or sensitive nature) outside UBC.

Can UBC’s Email System be Hosted Outside Canada?

13. FIPPA prohibits UBC from storing sensitive personal information outside Canada unless a Privacy Impact Assessment has been conducted that considers the risks of the foreign storage. UBC’s work email system is hosted in Canada.
14. The majority of third party email providers (Hotmail, Gmail, etc.) cannot be used for UBC business purposes because they store data outside Canada and have not been approved through the Privacy Impact Assessment process.

Can I Check My Emails When I am Travelling Outside Canada?

15. Yes. Temporary access from outside Canada is allowed.

How do I Respond to Emails from Accounts Hosted Outside Canada?

16. Many students use Hotmail or Gmail accounts, which are hosted outside Canada. If a student or another party initiates contact with you using such an account, it is acceptable for you to respond to their email and to discuss the individual’s personal situation if the individual requests you to do so. However, you cannot disclose information about anybody else.

Can I Use my UBC Email Account for Personal Purposes?

17. While work email accounts are intended for official use, UBC policy authorizes the incidental personal use of these accounts, provided such use does not interfere with the user’s job performance and is not otherwise an inappropriate use under relevant policy or legislation.¹ An example of an “incidental personal use” of your UBC email account would be sending a short message to a friend inviting him to lunch. You should not use your UBC email account for long or sensitive personal communications.
18. If you use your UBC email account for personal uses, keep in mind that your communications may not remain private. While the University does not, as a routine matter, inspect personal emails stored on UBC email accounts, it may need to access these emails under certain circumstances, e.g. responding to lawful subpoenas or court orders; investigating misconduct and determining compliance with University policies; and searching for electronic messages, data, files, or other records that are required for University business continuity purposes.

Can I Auto-Forward my UBC Email Account to a Non-UBC Account?

19. Automatically forwarding or redirecting UBC email accounts to a non-business email account (e.g. a personal Gmail, Hotmail or Yahoo account) is not permitted under UBC’s Information Security Standards². Auto- forwarding to non-UBC corporate/business email accounts is only acceptable for UBC faculty and staff members who have employment or appointments at other organizations and are unable to manage multiple work email accounts. Under these circumstances, auto-forwarding is acceptable if:
    1. the other organization is a public body located in British Columbia and is subject to the Freedom of Information and Protection of Privacy Act, including the associated data residency and security requirements; and
    2. the faculty or staff member ensures that copies of emails are retained on or copied to UBC Systems in accordance with UBC’s Records Management Policy.

20. Auto-forwarding to non-UBC business email accounts outside of the circumstances set out in paragraph 19 is prohibited unless the user has submitted a UBC Email Auto-forwarding Agreement and it has been approved by the Administrative Head of Unit and Chief Information Security Officer.

21. For example, UBC faculty members who work at Vancouver General Hospital generally use email accounts supplied by Vancouver Coastal Health (VCH). It is acceptable for these individuals to auto-forward their UBC email accounts to their VCH accounts. Most emails do not have to be retained because they are transitory in nature, or are copies of records that exist elsewhere. However, any emails which are considered to have evidential value must be retained so that they are secure and accessible to other UBC employees in the event they are needed. This may require printing them to paper, retaining a copy in a UBC email account, or capturing them in an electronic record keeping system.
22. Except as provided above, auto-forwarding is prohibited, for the following reasons:
    1. Privacy: Many UBC emails contain personal information, and FIPPA requires UBC to ensure that this information is adequately protected from unauthorized access.
    2. Security: Some UBC emails contain confidential or sensitive information. This information may not be adequately protected if it is stored on an external account.
    3. Records management: UBC’s Records Management Policy requires staff and faculty members to manage and preserve records of value, which includes email messages. Emails that are stored on external email accounts may not be preserved as required under that policy.