What is Personal Information?

Introduction

  1. The purpose of this Privacy Fact Sheet is to clarify the meaning of “personal information”, which is an important concept under the Freedom of Information and Protection of Privacy Act (FIPPA).
  2. This Privacy Fact Sheet is intended to assist UBC staff and faculty members to understand their obligations under FIPPA. It is not intended to be a substitute for legal advice. If you have specific questions about FIPPA, contact the Office of the University Counsel.

The Definition of “Personal Information”

  1. Under FIPPA, “personal information” is defined as “recorded information about an identifiable individual other than contact information.”

Personal Information is…

“recorded information about an identifiable individual other than [business] contact information”.

  1. “Contact information” is defined as “information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual.”
  2. Therefore, personal information comprises all recorded information about an identifiable individual, with the exception of the names and business contact information of employees, volunteers and service providers.
  3. You may have heard the terms “personally identifiable information” (PII) and “personal health information” (PHI) used to identify different types of personal information. These terms are not used in FIPPA. FIPPA does not distinguish between different categories of personal information.

The Meaning of “Identifiable Individual”

  1. Information is only considered to be personal information if it is about an “identifiable individual”. Individuals may be identified using their name or another unique number or characteristic, eg. photograph, SIN number, fingerprint, CWL ID, employee number, or student ID. Any information that has a precise, direct connection with one of these personal identifiers is personal information. For example:
    1. “John Smith is 40 years old.”
    2. “Sally Wang is a student.”
    3. “Student Number 123456 failed the Biology exam.”
    4. “The Dean of the Faculty of Engineering is sick today.”

  1. To determine whether information is about an “identifiable individual”, the Privacy Commissioner of Canada has formulated the following test: “Information will be about an identifiable individual where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other available information”.1
  2. You should exercise caution before releasing any data that was derived from underlying personal information, even if you think you have “de-identified” the data. Information technology provides powerful tools for analyzing and linking data. It may be possible for someone to re-identify individuals by combining seemingly innocuous bits of available data. This is sometimes called the “mosaic effect”.

Example: Student Grade Lists

A professor has prepared a list of students and their grades. He attempts to “de-identify” the students by listing them by their student IDs rather than their names. Does this list contain personal information?

Students do not always keep their IDs confidential. Therefore, there is a serious possibility that third parties will be able to use the IDs in the list to identify some of those students and find out their grades. For this reason, the list contains personal information.

The Meaning of “Contact Information”

  1. Information is not considered to be personal information if it is business “contact information”, which is the kind of information that appears on a business card. “Contact information” is defined as “information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual.”
  1. For example, the business contact information of UBC employees, faculty members, volunteers and service providers is considered to be “contact information”. As this information is not personal information, much of it is posted on UBC’s website for public viewing.
  2. Students’ names, mailing addresses, email addresses, and phone and fax numbers are not considered to be “contact information” under FIPPA. This is because students attend UBC in a personal, rather than a business, capacity. All information about students, including their names, is personal information and is protected under FIPPA.

When is an Address Personal Information?

  • “123 Main Street” is not personal information (because it can’t, by itself, be linked to an identifiable individual)
  • “Jane Doe works at 123 Main Street” is not Jane’s personal information (because it is her business contact information)
  • “Jane Doe lives at 123 Main Street” is Jane’s personal information

 

1 Gordon v. Canada (Health), 2008 FC 258 (CanLII)

Office of the University Counsel

6328 Memorial Road
Vancouver, BC Canada
V6T 1Z2
Tel 604 822 1897
E-mail university.counsel@ubc.ca

UBC Crest The official logo of the University of British Columbia. Urgent Message An exclamation mark in a speech bubble. Caret An arrowhead indicating direction. Arrow An arrow indicating direction. Arrow in Circle An arrow indicating direction. Arrow in Circle An arrow indicating direction. Chats Two speech clouds. Facebook The logo for the Facebook social media service. Information The letter 'i' in a circle. Instagram The logo for the Instagram social media service. Linkedin The logo for the LinkedIn social media service. Location Pin A map location pin. Mail An envelope. Menu Three horizontal lines indicating a menu. Minus A minus sign. Telephone An antique telephone. Plus A plus symbol indicating more or the ability to add. Search A magnifying glass. Twitter The logo for the Twitter social media service. User A silhouette of a person. Youtube The logo for the YouTube video sharing service.