Access to Information and Protection of Privacy

1.23 UWO Guidelines on Access to Information and Protection of Privacy

Effective Date: 23MAY96
Supersedes: (New)

As a publicly funded institution which operates with a high degree of autonomy and self-regulation, The University of Western Ontario affirms the importance of the principle of freedom of information and the obligation to conduct its operations as far as possible in ways that are open to public scrutiny. Also, The University of Western Ontario is committed to the protection of the privacy of individuals with respect to personal information about themselves held by the University. Therefore, The University of Western Ontario has enacted the following Guidelines to support these principles of openness, accountability and protection.

I. GENERAL

The Basic Principles
The purpose of these Guidelines is to create standards for access to information and privacy protection. The Guidelines are based on the following principles:
(a) As a general rule, with the exception of personal information, information contained in University records should be available to members of the University community and to members of the public more generally;
(b) The necessary exemptions from the general principle favouring access should be as limited and specific as possible;
(c) The collection, retention, use and disclosure of personal information contained in University records should be regulated in a manner that will protect the privacy of individuals who are the subject of such information; and
(d) Means should be established for the resolution of disputes within the University community concerning access to information and privacy protection matters.
Except for words that are specifically defined in these Guidelines, all words that are defined in the University of Western Ontario Act, 1982, as amended from time to time, have the same meaning herein as in that Act.
Relationship With Other University Policies
1. These Guidelines are not intended to replace or restrict presently existing procedures and practices within the University community relating to access to information that is not personal information, where such procedures and practices give access equal to or greater than that provided in these Guidelines.
2. Where a written University policy or procedure is, or has been, adopted, its explicit provisions shall, in the event of conflict, take precedence over these Guidelines. Where possible any new or revised policies should be developed in the light of the basic principles set forth in these Guidelines. All existing, new or revised policies shall be referred to the University Commissioner for review and comment under section 30.
Scope of the Guidelines
1. "Record" means any record of information, however recorded, whether in manuscript, printed, mechanical or electronic form and any copy thereof, but does not include a computer program or any other mechanism that produces records.
2. These Guidelines apply to the following records within the custody or control of the University:
  (a) student records, including both records of applicants and registered students;
  (b) staff and faculty personnel records;
  (c) alumni records;
  (d) fund raising and donation records;
  (e) administrative, financial and academic policy records pertaining to the University's operations;
  (f) subject to subsection 5 below, records held in archival collections at the University.
3. In particular, these Guidelines do not apply to the records of individual faculty members, students or other employees created or acquired pursuant to their responsibilities for teaching or research.
4. A record capable of being produced from machine readable records is not included in the definition of "Record" if the process of producing it would unreasonably interfere with the operations of the University.
5. (a) These Guidelines do not apply to records placed in archival collections at the University by or on behalf of a person or organization other than the University where ownership of the records is not transferred to the University.
  (b) In cases where material has been donated to archival collections at the University subject to restrictions imposed by the donor, such restrictions shall take precedence over these Guidelines.
6. These Guidelines do not apply to a personal note, communication or draft decision of a person who is acting in a quasi judicial capacity.
Nature of the Access Right
1. The right of access conferred by these Guidelines should normally be implemented by permitting, upon written request, supervised access to either the record or a copy of the record, subject to prior payment of the applicable fees.
2. Notwithstanding subsection (1), where an individual is granted access to a record containing personal information concerning him/herself, a written request from the individual for a photocopy of the record should normally be granted, subject to prior payment of the applicable fees.
II. ACCESS TO INFORMATION
The General Principle
1. Any individual shall be granted access to the records governed by these Guidelines unless,
  (a) the record falls within one of the exemptions set out herein; or
  (b) the Unit Head considers, upon reasonable grounds, that the request for access is frivolous or vexatious. *
  *(As used in these Guidelines, "frivolous" and "vexatious" shall be interpreted as legal terms and in accordance with any legislation or regulations that may be established by the government of Ontario relating to access of information.)
2. Where a request for access pertains to a record containing material which is exempt from the general principle of access together with material which is not exempt, and the Unit Head is not of the opinion that the request is frivolous or vexatious, the Unit Head shall make reasonable efforts to sever and disclose the non-exempt material.
Access Procedure
1. An individual seeking access to a record shall make a request, in writing, to the individual the person believes has custody or control of the record and shall provide sufficient detail to enable an experienced employee to identify the record.
2. If the Head of a Unit considers, upon reasonable grounds, that the request is frivolous or vexatious, subsection (3) does not apply.
3. If the request does not sufficiently describe the record, the individual to whom the request was submitted shall so inform the applicant and advise the applicant that further particulars will be required to bring the request within the provisions of s. 6(1).
4. The individual to whom the request is submitted shall, before giving access to a record, and within 15 days of receipt of the request, advise the individual requesting access of the estimated amount of the fee to be charged pursuant to section 31. The individual may then ask for a review of that fee pursuant to subsection 31(3) or withdraw the request or indicate in writing that he or she wishes to pursue the request.
5. Subject to subsection (6), access to a record will be granted within 30 days after the individual has indicated that the request is to be pursued, upon prior payment of the prescribed fee.
6. Where access to a record is denied, or a request to correct personal information pursuant to section 23 is denied, the individual to whom the request was submitted will provide written notice within 30 days after the receipt of a sufficiently detailed request indicating,
  (a) the reason(s) access is denied or correction of personal data is denied;
  (b) the name and the position of the individual responsible for making the decision; and
  (c) that the individual who made the request may appeal to the University Commissioner for a review of the decision.
Exemptions from the General Principle
Available Information
The University is not required to follow these Guidelines where:
(a) the record or the information contained in the record has been published or is currently available to the public, whether or not a fee is charged, or
(b) the record or the information contained in the record will be published by the University within ninety days after the request is made or within such further period of time as may be necessary for printing or translating the material for the purpose of printing it, whether or not a fee is charged, or
(c) the record contains personal information that is currently available to the individual to whom the information relates or to another party with the permission of the individual, through any unit of the University, whether or not a fee is or has been charged for that access.
Deliberative Processes
1. The University may refuse to disclose records containing matter in the nature of, or relating to, opinions, references, assessments, advice or recommendations obtained, prepared or recorded, or consultations or deliberations that have taken place, in the course of, or for the purposes of, the deliberative processes of the University where such disclosure would undermine the effectiveness of those processes.
2. Without restricting the generality of subsection (1), the University may refuse to disclose a record where disclosure would reveal the advice or recommendations of an individual employed in the service of the University or a consultant retained by it.
3. The disclosure of purely factual information would not be considered to be opinions, references, assessments, advice or recommendations.
4. The University may refuse to disclose a record,
  (a) that contains draft University legislation, regulations, policy statements or procedures; or
  (b) that reveals the substance of deliberations of a meeting of a board, council, committee, sub-committee or other body, including any record prepared for such meeting, unless such meeting is authorized pursuant to applicable University policies or procedures to be open to the public.
5. The exemptions referred to in subsections (1), (2) and (4) shall not be exercised with respect to a record which is more than 20 years old.
Conflict Resolution, Law Enforcement and Discipline
The University may refuse to disclose a record where disclosure could be reasonably expected to interfere with a law enforcement matter, investigation of misconduct or poor performance, or a disciplinary proceeding, complaint or conflict resolution process within the University.
Relations with Governments and Other Organizations
The University may refuse to disclose a record where disclosure could reasonably be expected to,
(a) prejudice the conduct of relations between the University and federal, provincial or municipal governmental authorities or other agencies providing funding to the University or any of its constituent units; or
(b) reveal information received in confidence from federal, provincial, municipal or foreign governmental authorities; or
(c) reveal information received in confidence from institutions affiliated with the University or from other universities, colleges and similar institutions and from organizations formed for the purpose of representing the interests of such organizations or various constituencies within them,
and shall not disclose any such record without the prior approval of the President.
Confidential Information
1. The University may refuse to disclose records where disclosure would reveal information supplied in confidence implicitly or explicitly where the disclosure could reasonably be expected to result in any undue prejudice, loss or gain to any person, group of persons, committee, organization or financial institution or agency or could reasonably be expected to result in similar information no longer being supplied to the University or could reasonably be expected to reveal information supplied to or the report of a conciliation officer, mediator, labour relations officer or other person appointed to resolve a labour relations dispute.
2. The University shall not disclose any record described in subsection (1) without the prior approval of the President.
Economic and Other Interests of the University
1. The University may refuse to disclose records containing
  (a) trade secrets or financial, commercial, scientific or technical information that belongs to the University or one of its constituent units or members; or
  (b) information owned by the University, if the disclosure could reasonably be expected to deprive an employee or the University of priority of publication; or
  (c) information where the disclosure could reasonably be expected to prejudice the economic or financial interests or the competitive position of the University; or
  (d) positions, plans, procedures, criteria or instructions to be applied to any negotiations carried on or to be carried on by or on behalf of the University or one of its constituent units; or
  (e) plans relating to the management of personnel or the administration of the University or one of its constituent units that have not yet been put into operation or made public; or
  (f) information including the proposed plans, policies or projects of the University or one of its constituent units where the disclosure could reasonably be expected to result in premature disclosure of a pending policy decision or in undue financial benefit or loss to a person; or,
  (g) questions that are to be used in university examinations or tests.
2. The University shall not disclose any record described in subsection (1) without the prior approval of the President.
Research
The University may refuse to disclose information concerning the past, present or proposed research activities of members of the University community where disclosure would be contrary to the public interest or would undermine the professional or personal interests of the researchers, staff, students, or research sponsors involved in the project.
Solicitor-Client Privilege
The University may refuse to disclose records that are the subject of solicitor-client privilege or that have been prepared by or for counsel employed by or retained by the University for use in giving legal advice or in contemplation or for use in litigation.
Threat to Safety or Health
The University may refuse to disclose a record where disclosure could reasonably be expected to seriously threaten the safety or health of an individual.
Examinations, Tests and Audits
The University may refuse to disclose records where disclosure would undermine the effectiveness or fairness of an auditing procedure or of an examination, testing procedure or other means of evaluation of student performance.
Financial Data
In addition to the disclosure of financial information supplied within current practices, the University shall make reasonable efforts to disclose additional financial data which can be disclosed without infringing the various interests protected by the above exemptions from the access scheme.
Personal Information
The University shall refuse to disclose personal information to any individual other than the individual to whom the information relates except where otherwise provided in this policy.
III. PROTECTION OF PRIVACY
Collection of Personal Information
1. In these Guidelines, "personal information" means recorded information about an identified individual, including:
  (a) information related to the race, national or ethnic origin, first language, colour, disability, religion, age, sex, sexual orientation or marital or family status of an individual;
  (b) information relating to the educational, medical, psychiatric, psychological, criminal or employment history of the individual or to information about financial transactions involving the individual;
  (c) any identifying number, symbol or other identifier assigned to the individual;
  (d) the address or telephone number of the individual;
  (e) the individual's personal opinions or views, except where they relate to someone else;
  (f) correspondence received from an individual that is implicitly or explicitly confidential, and replies to correspondence that would reveal the contents of the original communications;
  (g) the views or opinions of another individual about the individual;
  (h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
  (i) beneficiary information supplied by the individual;
  (j) Employee Assistance Program information relating to an individual; and
  (k) information supplied by the individual relating to the individual's next of kin or guardian.
2. Personal Information does not include information about an individual who has been dead for more than thirty years.
3. The University shall collect and record only such personal information as is either reasonably necessary to the proper administration of the University and its academic and other programs or is required by virtue of data collection or reporting requirements lawfully imposed upon the University by federal, provincial or municipal governmental authority.
Use of Personal Information
The University shall use personal information in its custody or under its control only:
(a) if the individual to whom the information relates has identified that information in particular and has consented to its use; or
(b) for the purpose for which it was obtained or compiled or for a consistent purpose; or
(c) for statistical analyses, provided that such analyses do not identify individuals or disclose other personal information; or
(d) in other circumstances, where the use of the information is necessary and proper in the discharge of the University's duties and responsibilities; or
(e) in the case of personal information as defined above in section 19(1)(k), for the purpose of maintaining employee, alumni and development records and communications appropriate thereto.
Disclosure of Personal Information
1. The University shall not disclose personal information in its custody or under its control except under one of the following circumstances:
  (a) in accordance with section 23;
  (b) where the individual to whom the information relates has identified that information in particular and has consented to its disclosure;
  (c) for the purpose for which it was obtained or compiled or for a consistent purpose;
  (d) to an officer or employee of the University who needs the record in the performance of his or her duty, including the preparation or verification of employment references;
  (e) for the purpose of complying with a requirement to provide information lawfully imposed upon the University by a federal, provincial or municipal governmental authority;
  (f) where disclosure is to an institution or a law enforcement agency in Canada to aid in an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;
  (g) where disclosure is necessary to aid in the investigation of allegations that individuals have made false statements or engaged in other misleading conduct,
  1. concerning their attendance or performance or status within or completion of an academic program of the University; or
  2. with respect to an employment relationship;
  (h) where disclosure is made to another educational institution or to a professional licensing authority or board of certification or similar institution, provided that the University has made reasonable efforts to inform affected individuals of the existence of a practice of making such disclosures;
  (i) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;
  (j) in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;
  (k) to a person who has been authorized by the individual to whom the information relates to make an enquiry on that individual's behalf or, where that individual is incapacitated, has been authorized by the next of kin or legal representative of that individual;
  (l) to archival collections at the University for archival purposes;
  (m) to any individual for research or statistical purposes if the officer having custody of the records:
  1. is satisfied that the purpose for which the information is to be disclosed is not contrary to the public interest and cannot reasonably be accomplished unless the information is provided in a form that would identify the individual to whom it relates; and
  2. has approved conditions relating to the following:
    - security and confidentiality,
    - the removal or destruction of individual identifiers at the earliest reasonable time,
    - the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of the officer having custody of the records; and
  3. obtains from the individual a written agreement to comply with the approved conditions, these Guidelines and any other applicable University policy or procedure relating to the confidentiality of personal information; or
  (n) where disclosure is made to a physician or other health professional, to provide information for the assessment of disability, medical leave or similar claims.
2. Unless an individual specifically requests that the following information not be disclosed, the restrictions on disclosure set out in these Guidelines do not apply to disclosure of the fact that an individual is or is not, or was or was not, registered in a particular college, school, faculty or other division in a particular session or to the fact that an individual has or has not successfully graduated or completed a program on a particular date or has or has not received particular academic or other University honors and distinctions.
Retention and Disposal of Personal Information
The University shall take reasonable precautions to protect the security of records containing personal information, shall retain such information only for reasonable periods of time and shall make reasonable arrangements for the disposal or destruction of such records when that reasonable period has expired.
Access and Correction Rights
1. Subject to sections 6 and 24, any individual shall be granted access to records containing personal information concerning him/herself, provided that the individual is able to provide sufficiently specific information to render the records reasonably retrievable by the University.
2. Every individual who is given access in accordance with subsection (1) is entitled to,
  (a) request correction of the personal information where the individual believes there is an error or omission; and,
  (b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made.
Exemptions from the Access Right
The University may refuse to disclose records containing personal information or copies thereof to the individual to whom the information relates if it is:
(a) personal information that cannot be severed from information falling under the exemptions to the general access principle set out in sections 7 to 16;
(b) personal information that cannot be severed from the personal information about another individual or individuals, unless disclosure of the information can be made in accordance with section 21.
(c) medical or health-related information where the disclosure could reasonably be expected to prejudice the mental and physical health of the individual; or
(d) a research or statistical record; or
(e) evaluative or opinion material compiled solely for the purpose of:
1. determining suitability, eligibility, or qualification for employment, promotion, transfer, or for the awarding of a contract with the University;
2. determining eligibility for admission to or eligibility to proceed in an academic program of the University;
3. determining eligibility or suitability for the awarding of a scholarship, bursary or other form of financial assistance; or
4. conducting peer review processes related to determinations concerning issues including but not restricted to eligibility or suitability for the granting of an appointment, renewal of appointment, tenure or promotion, research grants or other benefits to members of the University community or for similar purposes;
where it may reasonably have been assumed by the source that the evaluative or opinion material provided by the source would be held in confidence or where the disclosure could reveal the identity of a source who furnished information in circumstances where it may reasonably have been assumed by the source that the identity of the source would be held in confidence.
IV. IMPLEMENTATION, MONITORING AND DISPUTE RESOLUTION
Implementation Responsibility
1. In these Guidelines "Unit Head" shall mean the Dean of an academic unit, or delegate, or the budget head of an administrative unit, or delegate.
2. The Unit Head shall be responsible for the implementation of these Guidelines within the Unit.
Responsibilities of the Unit Head
1. The Unit Head shall ensure that a decision concerning a request under section 6 for access to a record or a request under section 23 for correction of personal information is made, either granting the requested access and/or making the requested correction to personal information or communicating the decision to deny the request in accordance with section 6. When a Unit Head receives a request for access to information or for the correction of personal data in circumstances which raise a question concerning the proper application of these Guidelines, the Unit Head shall refer the request to the University Secretariat for an interpretation of the Guidelines.
2. The Unit Head shall ensure the cooperation of the Unit with the University Commissioner in the investigation of complaints received by the University Commissioner under section 29.
University Commissioner for Access to Information and Privacy Protection
The Board of Governors shall appoint a University Commissioner for Access to Information and Privacy Protection (the "University Commissioner"). The term of appointment is five years and may be renewed.**

** The Secretary of the Board of Governors has been appointed University Commissioner for a five-year term ending June 30, 2001.
Complaints to the University Commissioner
1. Any individual who is aggrieved by a decision of a Unit Head with respect to a request under section 6 for access to information or the correction of personal data under section 23 or fees to be charged under section 31, may complain, in writing, to the University Commissioner within 30 days of the decision of the Unit Head.
2. Any individual may file a complaint with the University Commissioner if response to a request made pursuant to section 6 is not received within the periods provided for in section 6. Such complaint must be filed within 30 days after the time periods set out in subsections 6(5) and (6).
3. An individual who files a complaint may be required to pay a fee prior to the investigation of a complaint. Such fee will be set by the Board of Governors from time to time.*** At the discretion of the University Commissioner, a fee may be refunded in full or in part.
  
  *** The current fee is $100.00.
Investigations and Recommendations
1. The University Commissioner shall receive, investigate and report on complaints received under section 28.
2. The University Commissioner may dismiss a complaint without an investigation if the written complaint does not present a reasonable basis for concluding that the record or the personal information to which the complaint relates exists.
3. The University Commissioner shall have full authority to determine the manner in which a complaint shall be investigated and the procedures to be followed in any hearing, interview or proceeding that the University Commissioner may consider appropriate in order to effect a proper disposition of the complaint.
  (a) If, at the conclusion of an investigation, the University Commissioner finds that a complaint is not well- founded, the University Commissioner shall so inform the complainant and the relevant Unit Head.
  (b) If, at the conclusion of an investigation, the University Commissioner finds that the complaint is well- founded, the University Commissioner shall file a written report with the President concerning the investigation, including the recommendation of the University Commissioner. A copy of the University Commissioner's recommendation shall be sent to the complainant and to the Unit Head.
  (c) The recommendation of the University Commissioner shall not be binding on the President. The President shall report in writing to the University Commissioner within the period of time specified by the University Commissioner whether and to what extent the recommendation of the University Commissioner is to be followed. In the event that the University Commissioner's recommendation is rejected by the President, the President shall indicate, in writing, to the complainant and the University Commissioner the reasons for rejecting the recommendation.
4. "President" shall mean the President or such other person designated by the President to carry out those duties specified in these Guidelines.
Other Responsibilities and Powers of the University Commissioner
The University Commissioner shall have the following additional responsibilities and powers:
(a) to encourage within the University the adoption of record-keeping and disclosure practices consistent with these Guidelines;
(b) to review and make recommendations with respect to policies and procedures prepared by Units pursuant to Section 25;
(c) where, in the opinion of the University Commissioner, the collection of records containing personal information creates significant risks of privacy invasion, to require the appropriate Unit to prepare a written policy statement concerning that collection;
(d) to recommend, from time to time, appropriate amendments to these Guidelines;
(e) to review and comment on written policies on access and confidentiality adopted by any Unit in the University;
(f) to make available educational programs concerning implementation of and compliance with these Guidelines as appropriate; and
(g) to prepare and file an annual report with the President for review concerning the implementation of these Guidelines within the University and, in particular, the nature and disposition of any complaints made pursuant to section 28, above. The final report shall be filed with the Senate and the Board of Governors.
Fees
1. The Unit Head may require the individual who makes a request for access to a record or for correction of a record to pay:
  (a) the costs of every hour of manual search required to locate a record;
  (b) computer and other costs incurred in locating, retrieving, processing and copying a record;
  (c) shipping costs;
  (d) any other costs incurred in responding to a request for access to a record;
  (e) the cost of adding to a record, pursuant to section 23 (2); and
  (f) where the requester is not a student of the University, a member of the teaching or administrative staff, or a representative campus group, an application fee which will be set by the Board of Governors from time to time.
2. The Unit Head may waive the payment of all or any part of an amount required to be paid under this Guideline where, in the Unit Head's opinion, it is fair and equitable to do so.
3. An individual who is required to pay a fee under subsection (1) may ask the University Commissioner to review the Unit Head's decision to charge a fee or the amount of the fee. Any request made to the University Commissioner to review the Unit Head's decision to charge a fee must be dealt with before the University incurs the costs involved in locating, retrieving and processing a record.

Approved by Senate May 9, 1996
Approved by the Board May 23, 1996