Frequently Asked Questions
Telephone: (709) 864-8753
- What is ATIPPA?
- What is a record?
- What is an ATIPP request?
- Who do I contact at Memorial if I have a question about ATIPPA?
- Do I have to file a formal request under ATIPPA to access information about Memorial University or about me?
- How do I file a request for information in the custody or under the control of Memorial University?
- How much will it cost to obtain general information?
- How much will it cost to obtain personal information about myself?
- How long must the university keep my personal information?
- What exactly is personal information?
- What about PIPEDA?
- Will a student be able to access a letter of reference that was submitted in confidence when s/he is the subject of the information?
- Can the Registrar release a student's address/phone number to a faculty member who is teaching the student?
- Can a faculty member ask a student for personal information?
- Can student grade lists be posted?
- How should marked exams, lab reports, and essays be distributed to students? Can they be left on a table in the hallway or in the classroom so that students can retrieve them on their own? Do they need to be returned in sealed envelopes?
- Can employees have open access, via computer or hard copy, to student information?
- Can the University release student information to a collection agency when a student has outstanding accounts?
- Is a verbal consent to use photographs for marketing purposes adequate or should waivers be signed where students are identified or identifiable?
- Does e-mail correspondence received from students need to be retained for a specific length of time?
- Are personal records of an employee that are located on University property accessible under ATIPPA?
- How long must application forms for unsuccessful candidates or unsolicited application forms be kept?
Q: What is ATIPPA?
A: The Access to Information and Protection of Privacy Act (ATIPPA) is a Newfoundland and Labrador law which governs provincial public sector organizations – government departments, agencies, boards, commissions, municipalities, schools and school boards, and public post-secondary institutions. Public body is a defined term in ATIPPA.
• gives people a right of access to records
• gives people a right of access to personal information about themselves
• gives people a right to request correction of personal information about themselves if they believe it contains an error or omission
• prevents the unauthorized collection, use and disclosure of personal information by public institutions
• provides for an independent review of decisions made by public institutions under ATIPPA
The right of access to records is subject to specific exceptions to disclosure (sections 18 to 30). These exceptions are designed to protect information such as personal information, law enforcement activities, third party business information, and legal advice. As well, exceptions may be applied where disclosure may harm conservation or individual or public safety.
ATIPPA protects privacy by placing limits on the collection, use and disclosure of personal information. As well, public institutions are required to ensure that personal information is held securely and is accessible only by those who need access to the information in order to carry out their job responsibilities.
Q: What is a record?
A: Record means “a record of information in any form.” It includes information that is written, photographed, recorded or stored in any manner. It includes hard copy and electronic data, including email.
Some types of records are excluded records and cannot be accessed under ATIPPA. These include court records, questions to be included on an examination or test, and teaching materials and research information of employees of post-secondary institutions.
Q: What is an ATIPP request?
A: An ATIPP request is made in writing, using a specific application form, and should be submitted to Memorial’s IAPP Coordinator. A $5 application fee is required to be paid. ATIPP requests must be responded to within 30 days, unless the time limit is extended – an extension may be necessary if the request involves a large volume of records, or if the information contains information which may affect third parties, or if the request is vague. The right of access is set out in Part II of ATIPPA.
The IAPP Coordinator is designated under section 67 of ATIPPA to receive and process ATIPP requests, to make recommendations for disclosure, and to coordinate responses for approval by the head of the university (the President).
The disclosure of information is subject to the exceptions to disclosure in ATIPPA. For example, another person’s personal information may need to be severed from a record.
ATIPP requests are subject to fees for time involved in searching, identifying and locating records and for photocopies.
Q: Who do I contact at Memorial if I have a question about ATIPPA?
A: Rosemary Thorne
Information Access and Privacy Protection Coordinator
1 Clark Place
Memorial University of Newfoundland
St. John's, NL A1C 5S7
Q: Do I have to file a formal request under ATIPPA to access any or all information about Memorial University or about me?
A: No. ATIPPA is in addition to and does not replace existing procedures for access to information or records. It should be seen as an instrument of last resort. Memorial will continue to routinely provide information when requested and proactively disclose information to the community. However, when routinely and proactively disclosing information, the University must not disclose another person’s personal information or business information that could harm a third party.
Q: How do I file a request for information in the custody or under the control of the Memorial University?
A: Try first to access the records you are seeking through existing procedures. A formal ATIPP request should be directed to the Information Access and Privacy Protection Coordinator. Complete the Application Form and send it to:
Information Access and Privacy Protection Coordinator
1 Clark Place
Memorial University of Newfoundland
St. John's, NL A1C 5S7
Phone: 709 864 8214
Q: How much will it cost to obtain general information?
A: In addition to the $5 application fee, an ATIPP request for access to general records may be assessed fees in accordance with the Fee Schedule set down by the Minister Responsible for ATIPPA.
Q: How much will it cost to obtain personal information about myself?
A: All ATIPP requests for access to your own personal records must be accompanied by a $5 application fee. However, no other fees are applied to your request for your own personal information.
Q: How long must the university keep my personal information?
A: Under ATIPPA, the university must keep personal information that has been used to make a decision affecting an individual for at least one year.
Q: What exactly is personal information?
A: Personal information is “information about an identifiable individual.” It includes among other things a person’s name, address, telephone number, age, health, financial and educational information, and identifying numbers and symbols like a student number and employee number. This is not an exhaustive list. Any information about an identifiable individual is that person’s personal information. (Section 2 of ATIPPA)
People’s opinions are also considered to be their personal information. An opinion about another individual, however, is considered to be the personal information of both the opinion-holder and the person the opinion is about. Let’s say you make a complaint to City Hall about your neighbour. The opinion you express is your personal information. However, the opinion is also your neighbour’s personal information, since it is about him. When City Hall responds to your complaint by contacting your neighbour, he may want to know who is making the complaint against him. The tug of war over who owns the personal information is resolved by providing the neighbour with the content of the opinion but not the identity of the person making the complaint.
The University holds personal information belonging to students, faculty, staff, alumni, donors and others. Sometimes personal information may be categorized as sensitive personal information. Most often, people consider their health information to be sensitive personal information; others may feel that their personal financial information is particularly sensitive. In terms of privacy risks like unauthorized access, credit card numbers and social insurance numbers are considered to be sensitive personal information.
Personal information is defined in Section 2 of ATIPPA. It reads:
"personal information" means recorded information about an identifiable individual, including
• the individual's name, address or telephone number,
• the individual's race, national or ethnic origin, colour, or religious or political beliefs or associations,
• the individual's age, sex, sexual orientation, marital status or family status,
• an identifying number, symbol or other particular assigned to the individual,
• the individual's fingerprints, blood type or inheritable characteristics,
• information about the individual's health care status or history, including a physical or mental disability,
• information about the individual's educational, financial, criminal or employment status or history,
• the opinions of a person about the individual, and
• the individual's personal views or opinions
Q: What about PIPEDA?
A: Any organization that collects, uses or discloses personal information in the course of commercial activities is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). For information on PIPEDA, please visit the Privacy Commissioner of Canada’s website at http://www.privcom.gc.ca/.
Q: Will a student be able to access a letter of reference that was submitted in confidence when s/he is the subject of the information?
A: Generally speaking, evaluative opinions are the personal information of the person being evaluated and ATIPPA allows individuals, subject to limited and specific exceptions, a right of access to personal information about themselves. In the case of a reference letter submitted by a writer with the expectation that it would be held in confidence, the privacy rights of the author may limit the right of the subject to access the letter.
Q: Can the Registrar release a student's address/phone number to a faculty member who is teaching the student?
A: This information would only be supplied on a need to know basis. Section 39(1)(f) allows for disclosure to an employee of Memorial University if the information is necessary for the performance of his or her duties. The onus is on the faculty member show that the information is necessary.
Q: Can a faculty member ask a student for personal information?
A: Yes. A faculty member is permitted to ask a student for personal information if the information relates directly to and is necessary for an operating program or activity of the course or program. S/he would also have to inform the student of the purpose for which the information is required.
Q: Can student grade lists be posted?
A: Grade lists should be posted only if the department has taken reasonable precautions to assure the confidentiality of the information: these include not using names, using only the last three or four digits of student numbers, and notifying students of the method of informing them of interim grades. If a class is so small that grade holders are easily identified despite any process to conceal identities, then grade lists should not be posted.
Q: How should marked exams, lab reports, and essays be distributed to students? Can they be left on a table in the hallway or in the classroom so that students can retrieve them on their own? Do they need to be returned in sealed envelopes?
A: Section 36 of ATIPPA states that the head of a public body must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or destruction. As a result, the practice of placing graded examinations and assignments in a public place for pick up is not in keeping with privacy legislation. Examinations and assignments should be returned directly to the student. Graded assignments may be left on a desk in the classroom so that students can retrieve their own exam/assignment only if the instructor or a teaching assistant is present to supervise. Grades and comments should not be made on the cover or first page of an assignment. Ideally, graded assignments should be returned directly to the student.
Q: Can faculty and staff have open access, via computer or hard copy, to student information?
A: No. The fact that access to student information is possible does not imply that all employees should have access to all student information. Faculty and employees should have access only to information that they require to perform their duties as an employee of the University.
Q: Can the University release student information to a collection agency when a student has outstanding accounts?
A: Section 39(1)(i) allows disclosure for the purpose of collecting a fine or debt owed by an individual to the University.
Q: Is a verbal consent to use photographs for marketing purposes adequate or should waivers be signed where students are identified or identifiable?
A: The Act makes no provision for verbal consent. If the program in which the student is enrolled or participating is one where such promotion is a reasonable use of a photograph, then this use should be stated in the privacy notice provided at the time of collection. (e.g. sports teams, music programs, fine arts programs). If the promotion is not a regular part of the program, specific written consent should be obtained prior to use of a photograph.
Q: Does e-mail correspondence received from students need to be retained for a specific length of time?
A: The University is required to keep all records used to make a decision affecting a person for one year. If the e-mail message documents a decision and is not recorded in a more permanent format, it should be kept for one year. If the information is of temporary value or has been transcribed in a formal memo, it is considered transitory and should be retained only as long as it is required.
Q: Are personal records of an employee that are located on University property accessible under ATIPPA?
A: Generally personal records of an employee are not covered by ATIPPA. However, if the records of an employee relate to the operational functions of the University, then the records are the property of the University and are covered by ATIPPA. If an employee’s records are used in decision-making or program activity, then they are considered to be University records and thus, subject to ATIPPA.
Q: How long must application forms for unsuccessful candidates or unsolicited application forms be kept?
A: If the University uses the application form to make a decision about hiring or not hiring the individual, it must be retained for at least one year. Unsolicited applications or resumes would only be retained if they were considered in the process of a personnel search.