FOIP @ NAIT
Can an Institute collect third party information from students (e.g. parents' date of birth/education)?
Section 34 of the Act governs the manner of collection of personal information. In order for the Institute to collect such information about third parties, it would have to be able to prove that the information was necessary to determine or verify the eligibility of the student to participate in a program or receive a benefit, service or product from the Institution. (Section 34(1)(k)) If it cannot do this, then the parents would have to authorize collection by the Institute from their son or daughter, or the information would have to be collected directly from the parents (e.g. credit card information). The Institute should take care to collect only that information which is related directly to and necessary for student admission and attendance at the Institute.
Can the Registrar confirm that a student is registered in a specific program at the Institute in response to a third party inquiry?
Yes. Under Section 17(2)(j), this disclosure would not be seen as an unreasonable invasion of the student's privacy, provided the student has not specifically asked that this information not be disclosed (Section 17(3)).
Can the Registrar refuse to release an official transcript or diplomas to a student who owes money to the Institute for tuition fees, or for library books or equipment that has not been returned?
Yes. The Institute can refuse to issue an official transcript or official diploma unless the student settles the outstanding account but should issue a statement of grades to the student, instead. However, if the student submits a FOIP request for his/her own official transcript or diploma, the Institute would not be able to withhold this personal information on the basis that the student owes the Institute money. Section 6 provides an applicant with a right of access to any record in the custody of under the control of the Institute, subject to specific and narrow exceptions. The Institute would not issue an official transcript or diploma, only a photocopy of it.
Can an Institute share information about students with its students association?
Yes, but only to the extent that an agreement between the Institute and the Student Association requires information sharing (Section 40(1)(e)). Sharing personal information without an agreement is likely not a consistent use of information collected from students by the Institute. However, an Institute can't enter or uphold an agreement that breaches an individual's privacy under the Act. Other information sharing should only be done with the consent of the student. Consent could be gathered at the time of registration.
Students often ask for copies of documents they submitted in support of their application. This could include high school, college or university transcripts, medical information or reference letters. Does the Institute have to supply such copies?
Yes. A student has a right to the record even though in some cases the documents are ones they originally submitted. It is not automatic that they get the full record as the Institute has to ensure that it does not disclose personal information which would be an unreasonable invasion of the privacy of a third party or confidential information supplied directly to the Institute.
Is there a limit on how many additional copies of unofficial transcripts a student can ask for or can the Institute charge for re-issuing the statement?
The FOIP Act is in addition to, and does not replace existing informal procedures that the Institute has in place, for access to certain records (Section 3(a)). In most cases, a student or former student request for a transcript is going to be made to the Registrar's office and should not require the formality of a FOIP request. The Institute's policy of charging a fee to defray photocopying costs for such requests, should be followed. In the event of a formal FOIP request, fees and costs charged would be in accordance with the Regulations under the Act. In the event of multiple formal FOIP request by the same individual for the same documents, there is provision under the Act to request authorization from the Privacy Commissioner to disregard one or more requests, if they are frivolous or vexatious (Section 55).
How should a public body deal with telephone inquiries from students about information about their own record?
The Institute should satisfy itself of the identity of the person calling, perhaps through questions based on the student record the answers to which only the student is likely to know (e.g. courses taken, name of faculty, student number). Address and phone number are not sufficient proof of identity, as they could easily be known by others. Whenever practical, the caller should be asked to submit their request in writing, with their signature included on the request.
In dealing with appeals, complaints and requests for refunds, information must sometimes be obtained on students' attendance and performance and student loan information. Can this collection continue under the Act?
Yes. Section 40(1)(h) permits disclosure to an employee of the Institution in order for that person to perform their duties. The disclosure should be limited to the information needed to do the job and only provided to the individual who has a need to know that information.
Can the Institute collect the SIN from students?
The only circumstance where a SIN should be collected is where the Institute has a reporting requirement to the Federal Government, or where legislation authorizes the collection for another purpose.
Can the finance department of the Institute disclose student information to a collection agency when a student owes a debt to the Institution?
Section 40(1)(k) allows disclosure for the purpose of collecting a fine or debt owing by an individual to the Institute or to an assignee of the Institute. A notation of the disclosure should be place on the accounts receivable record.
What information may be disclosed to the collection agency that is trying to collect a debt owed to the Institute?
The Institute should disclose only the information needed by the collection agency to do its job. This would likely mean name, home address and telephone number and, if the student is working, business address and telephone number, as well as the amount owing.