Freedom of Information
The Freedom of Information and Protection of Privacy Act (FIPPA) was amended in 2005 to include Ontario universities. This means that these institutions, as of June 10, 2006, are subject to the freedom of information and personal privacy protection requirements in the Act and regulations.
FIPPA Institutional Summary – Summary 2007
General
Protection of Privacy
Getting Access to Information
GENERAL
Why is making universities subject to the requirements of FIPPA important to faculty and faculty associations?
Faculty, as generators or keepers of records, may be required to provide those records in response to a Freedom of Information request. Individual faculty or faculty associations may wish to generate requests for records held by members of the administration, for example. Faculty and administrations will be required to comply with the standards and practices for protection of personal privacy set out in the Act, regulations, and policies of the Office of the Information and Privacy Commissioner.
The Act governs two main areas: (1) access to information under the control of the institutions and educational institutions covered by the Act; and (2) protection of the privacy of individuals with respect to personal information about themselves and to provide individuals with a right of access to that information held by the institutions/educational institutions.
The right of access is governed by the principles that information should be available to the public and exemptions from rights of access should be limited and specific.
The Act can be accessed electronically at www.e-laws.gov.on.ca.
What is the role of the Information and Privacy Commissioner (the “IPC”)?
The IPC acts independently of government to uphold and promote open government and the protection of personal privacy.
Under its statutory mandate, the IPC is responsible for: resolving appeals from refusals to provide access to information; investigating privacy complaints about information held by government organizations and educational institutions; ensuring that the government organizations and educational institutions comply with the access and privacy provisions of the Acts; educating the public about Ontario’s access and privacy laws; and conducting research on access and privacy issues, and providing advice and comment on proposed government legislation and programs.
The Commissioner has produced a number of guides, pamphlets, explanatory and educational materials that are free of charge and can be downloaded from its website.
How can I contact the Office of the IPC?
The Office of the Information and Privacy Commissioner contact information is available on its website www.ipc.on.ca. The Office will provide guidance and information on how to request information, how to appeal a decision, and personal privacy issues.
The Office is located at 2 Bloor Street East, Suite 1400, Toronto M4W 1A8. 416-326-3333 or 1-800-387-0073.
Has the IPC produced any material that might be useful for me if I want to access a record and learn more about privacy protection practices?
There are a number of free, downloadable guides, pamphlets, research papers, and other materials available on the IPC website. Examples include best practices in maintaining, retaining, securing and providing access to e-records, best practices for protecting individual privacy in conducting survey research, and best practices for online privacy protection.
The Government of Ontario has also produced materials which you might find useful, including a manual on the Act and how to use it, available at www.accessandprivacy.gov.on.ca/english/manual/index.html
Please note that all current materials will have to be updated to include universities.
Who is responsible for compliance with FIPPA at a university?
The President of the university is responsible for decisions made under FIPPA and for the administration of the Act within the university community. He/she may delegate this responsibility. However, even if authority is delegated, the President will remain accountable for actions taken and decisions made.
Information on each university’s FIPPA offices and services is available and will be updated regularly. (CHART)
PROTECTION OF PRIVACY
Are faculty association records subject to the legislation?
Faculty association records are not subject to requirements under FIPPA. However, they may be subject to the requirements of federal legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA expressly includes trade unions in its definition of organizations. However, PIPEDA limits its applications to organizations that collect, use or disclose personal information in the course of commercial activities. It is doubtful that the primary activity of a trade union, providing representation for its members in exchange for dues, would be considered commercial activity in the meaning of PIPEDA. At this time, most legal experts take the view that a trade union’s core activities cannot be considered commercial in nature. However, a definitive court ruling does not yet exist.
How do I find out about best practices related to protection of privacy?
The Commission has published a number of best practice guides, dealing with survey research, e-records, and online privacy protection. You can access these guides at www.ipc.on.ca.
Can student evaluations of a faculty member be disclosed to persons other than the faculty member?
Section 39(1) of the Act precludes the collection of information about an individual, from others than the individual without the individual’s authorization, except in limited circumstances that are not applicable in this case. Therefore, a university is not entitled to solicit the “views or opinions” of students about faculty unless the faculty have granted their consent.
Many collective agreements in Ontario universities mention student evaluations of faculty in the context of personnel files and the evaluation of faculty or courses. Those provisions must be considered carefully to determine whether express or implied consent by each faculty member has been given for the collection of the information from students.
Pursuant to section 31(g) of the Act, the disclosure of the results of the student evaluations would constitute an unjustified invasion of personal privacy. However, section 42 of the Act permits the disclosure of such information where the person to whom the information relates has consented to its disclosure or “for the purpose for which it was obtained or compiled or for a consistent purpose”.
Since the collection of the personal information in this case can only occur with the consent of the faculty member, the “purpose for which it was obtained or compiled” is limited by the original consent for the collection of the information unless a specific expansion of the consent is granted later. Therefore, a review of the collective agreement is required to determine whether consent to release the information collected from students is granted. If the consent is limited to the purpose of evaluation, then it is arguable that the information collected from students can not be disclosed to others than the faculty member and administration.
Can personal faculty information, e.g. merit evaluations, be disclosed to persons other than the faculty member?
Pursuant to section 21(3)(d) and (g) of the Act, the disclosure of merit evaluations and other personal faculty information, to persons other than the faculty member, would constitute an unjustified invasion of personal privacy. However, section 42 of the Act permits disclosure of such information where the person to whom the information relates has consented to its disclosure or “for the purpose for which it was obtained or compiled or for a consistent purpose”. The purpose of merit evaluations is to evaluate the faculty member for the purpose of determining entitlement for a merit increment. Section 42 would not justify the disclosure of merit evaluations for other purposes. In each case, the purpose of the collection of the personal information will need to be determined in order to assess the breadth of legitimate distribution.
May a faculty member appeal the decision of a Head to disclose information to another person?
A faculty member who is affected by a request for disclosure will receive notice from the Head pursuant to section 28 of the Act describing the contents of the record that relates to the faculty member. If the faculty member wishes to contest the disclosure, the faculty member must, within 20 days after the notice is given, make written representations to the Head as to why the record should not be disclosed.
If the Head decides to disclose the record, further notice is given to the faculty member of that decision and the faculty member has 30 days within which to appeal the decision to the Privacy Commissioner pursuant to section 50 of the Act. The Act does not require the Head to wait 30 days from the decision to disclose to give the person who made the request access to the record. It is important for faculty members who wish to appeal a decision to disclose that they feel adversely impacts on their personal privacy to do so immediately on receipt of notice of the decision to disclose to prevent interim disclosure.
Can I continue to post and/or circulate either on paper or electronically sign-up sheets for seminars, special events, etc. that would provide students’ names and contact information?
Information such as names and contact information is considered personal information under FIPPA. You should explicitly tell students that a sign-up sheet will be used and that the personal information they provide will be disclosed to other students and administrative staff for purposes of organizing the seminar or event. You may want to add an explicit disclaimer to the e-document or document saying that by signing up the student is consenting to disclosure of the provided personal information. You should also provide an alternative means of registration for students who do not want their personal information made public. (e.g. contact xxxxx at xxxxx for alternative registration procedures).
GETTING ACCESS TO INFORMATION
What are some examples of useful information I might want to request from the administration?
OCUFA has had varied success over the years in obtaining even the most basic information from university administrations. In 2004 OCUFA sent identical requests to all Ontario universities for data on faculty hiring and hiring plans. Only three universities responded fully to our request. We anticipate that we will increase our FOI requests to gather relevant and useful data.
Faculty have expressed interest in the terms of some large endowments at their institutions and potential impacts on areas such as academic freedom. Information about such matters may be easier to obtain now.
However, the Act provides for a number of exemptions from disclosure. We anticipate that administrations may routinely refuse to disclose certain types of records using s. 17 and/or s. 18 of the Act which provide for exemptions based on prejudicing a competitive position or “financial, commercial, scientific, or technical information” that belongs to a university and has monetary or potential monetary value, among other things.
Records in university archives receive the same protections as do the records in the Ontario archives.
Amendments to FIPPA permit universities to collect information for the purposes of fundraising, but require universities to give notice that such information is being collected from donors.
If the faculty association is a “trade union” under the OLRA, why are the provisions of the OLRA related to employer disclosure of information preferable to FIPPA in relation to collective bargaining issues and related research.?
Section 70 of the OLRA provides:
70. No employer or employers’ organization and no person acting on behalf of an employer or employer’s organization shall participate in or interfere with the formation, selection or administration of a trade union or the representation of employees by a trade union…
In several decisions, the Ontario Labour Relations Board has found that section 70 requires an employer to provide a trade union with the names, addresses and telephone numbers of employees for whom the union has bargaining rights. The Board has found that it is not reasonably possible for a trade union to engage properly and effectively in collective bargaining without being able to communicate effectively with its members. In these cases, the employer has argued that the release of the information to the union would be an unreasonable invasion of privacy under privacy legislation. The Board has found that the obligation of a trade union to represent its members under the OLRA justifies the invasion of personal privacy arising from the disclosure of the information about the employer’s employees (section 21(1)(f) of the Act).
Will there be potential access to new records that were not obtainable under the employer disclosure requests under the OLRA, especially in the areas of finance, administration, human resources, and fundraising?
Section 70 of the OLRA has been interpreted to require an employer to disclose the names, addresses, and telephone numbers of bargaining unit employees to the trade union. In addition, the obligation to bargain in good faith (s. 16 and 59 of the OLRA) has been interpreted to require an employer to provide the bargaining agent with the information necessary for it to reach informed decisions in bargaining. However, the obligation to disclose only arises once a notice to bargain has been served and is generally limited to de facto decisions.
Bargaining agents may seek disclosure under FIPPA just as any other member of the public may. A number of trade unions across the country have found FOI requests to be a useful tool to obtain information about internal strategic planning, policy development, public regulation compliance, etc. The possibilities for FOI requests are limited only by one’s imagination and the specific exemptions under the Act. Universities may particularly rely on sections 18(e), (f), and (g) to limit disclosure requested by faculty associations of strategic planning records.
Which records are exempt from the application of the Act?
Records pertaining to academic research are excluded from FIPPA, as are teaching materials collected, maintained or prepared by an employee of an education institution. FIPPA does allow, however, the disclosure of the subject matter and amount of funding received by a researcher.
FIPPA does not apply to records of most employment-related or labour relations negotiations, meetings or communications in which an educational institution has an interest.
What are the exemptions from disclosure most relevant to faculty (in other words, records that a Head may refuse to disclose if certain conditions are met )?
A university may refuse to disclose to the individual to whom the information relates evaluative and opinion material supplied explicitly or implicitly in confidence for the sole purposes of: (i) assessing the teaching materials or research of the individual; (ii) determining suitability, eligibility or qualifications for admission to an academic program, or determining suitability for an outstanding achievement or distinguished service award.
A university may refuse to disclose questions that are to be used in an examination or test for an educational purpose. Specifically, the Act stipulates that requests to disclose “information relating to specific tests or testing procedures…that are to be used for an educational purpose, if disclosure could reasonably be expected to prejudice the use or results of the tests or testing procedures…” may be refused.
Information related to closed meetings of governing boards or governing board committees at a university may be exempted, subject to certain conditions. (s. 18(1).
How protective is the exemption to records “respecting or associated with research” mentioned in FIPPA ? Are there any potential concerns with how the amendment to FIPPA is worded in relation to faculty rights to plan, conduct and disseminate original research?
Section 65(8.1) provides:
(8.1) This Act does not apply,
(a) to a record respecting or associated with research conducted or proposed by an employee of an educational institution or by a person associated with an educational institution; or
(b) to a record of teaching materials collected, prepared or maintained by an employee of an educational institution or by a person associated with an educational institution for use at the educational institution.
The amendment to the Act became effective June 10, 2006 and has not yet been considered by either the Privacy Commissioner or the courts. OCUFA’s lawyer’s opinion is that the wording of the amendment is sufficiently broad to protect records that are produced at the earliest stages of the development of research. To assist in supporting the assertion that documents associated with research, either in progress or proposed, are exempt records, faculty may be well advised to note on the record that it was produced for that purpose. Similarly, faculty would be well advised to document any “proposed” research ideas. Legal counsel discussed the amendment with government officials responsible for the Act and were advised that the language adopted was not modeled on any other jurisdiction, so there are no interpretations at this time to provide guidance.
How can I make a request to the administration for a record under the FOI provisions?
Institutions covered by the Act, including universities, must make available to the public descriptions of the institution’s records and personal information banks. This information is intended for public use and will help determine the types of records generally maintained by the university. The information must include a description of the university and its responsibilities, a listing of the types or classes of records in the custody or control of the university, an index describing all the personal information banks including the name and location of the banks, the legal authority for it, a description of the types of personal information and how it is used on a regular basis, etc. Having access to this information should assist in drafting an appropriate request for a record.
Not all universities have compiled this list at writing. Check with your information and privacy coordinator on whether a reading room has been established and whether access request forms, fee schedules, etc. are available. (See separate list on this webpage for summary information on individual university progress with compliance.)
Under FIPPA, an access request must be in writing, be accompanied by a $5.00 application fee, and provide sufficient detail to enable “an experienced employee” of the university to identify the requested records. If you are seeking access to your own personal information, your request must also identify the personal information bank or its location. Requests in the form of questions are generally not acceptable, as they often do not provide sufficient detail for a university to respond appropriately. You should make it clear that you are requesting the record(s) under FIPPA.
Be as clear and particular as possible. Use date ranges where possible. (Do you want the minutes of a particular meeting of a particular board committee? Specify the date.)
You may request continuing access for a specified period up to two years. If your original request for access is granted, this means that like records that are generated in the future will be disclosed. (For example, you request access to a draft report and any future revisions.)
In general, you should expect a response within 30 days after a complete request has been received. A complete request is one that has been clarified or that provides sufficient detail for the university to determine if it has records that respond to the request.
You may also receive an estimate of costs that you will have to pay to reimburse the university for time, materials and services costs incurred to respond to your request. If it appears that the cost will be more than $25 you will receive a fee estimate before being granted access to the records.
Which electronic records may be disclosed under the Act (such as e-mails, course discussion groups, test results, etc)?
The Act draws no distinction between electronic records and records in printed form (s2(1) definition of “record”) and subject to the exceptions provided for in the Act, every person has access to all records in the possession of the university including those in electronic form. Some e-mails may constitute personal information (e.g. correspondence sent to the university by a faculty member that is implicitly or explicitly of a private and confidential nature – s.2(1) “definition of personal information”). Test results would also be personal information (s. 2(1)(b) “information relating to the education…of the individual…”). In each case, consideration must be given to whether the information falls within one of the exceptions to the general rule in favour of disclosure.
Is there any case law regarding access to donor information, donation agreements, or contracts (for example from the health sector)?
There have been a few Appeal Reports in response to requests under the Act for access to information about donations made to public institutions. However, they provide only limited guidance. Donor information that identifies the donor’s name and the amount of the donation would constitute personal information. In some cases, the disclosure of the personal information will be presumed to constitute an unjustified invasion of personal privacy because it will describe “an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities or credit worthiness” (section 21(3)(F)). In other cases, agreements with donors will not reveal personal information at all and may be disclosed.
How do I appeal if my request for access is denied?
Generally, any decision that a head (e.g. the President or his/her delegate) makes under the Act can be appealed.
The Information and Privacy Commissioner decides matters under appeal and can issue binding orders. The Commissioner’s order-making powers are broad and can include ordering a university to search its files in the presence of a Commission staff. The Commissioner cannot order an institution to create a record.
Under FIPPA, most of the exemptions that allow a record to be withheld are discretionary. The Commissioner cannot substitute her discretion for the head, but may review how the discretion was exercised.
How have universities prepared to respond to FOI requests?
Each Ontario university is making available on its website information related to how it intends to administer its responsibilities under the Act. When the information becomes available, OCUFA will post to this website the contact information for the FOI co-ordinators at each Ontario university. (See separate page in this site with summary information on individual university’s progress with compliance.)
Will OCUFA help me access records I want?
OCUFA will continue to work with faculty association executives to provide information on FIPPA and its administration at universities. The best source of assistance, both to access records and personal information, is the IPC and/or your university FOI co-ordinator.