Please Enter a Search Term

Frequently Asked Questions

If you cannot find the answer to your question or need more information, please contact the IAPP Office:

Telephone: (709) 864-8753

Email: iap@mun.ca

General

For Administrative Employees

FAQs for Academic Staff

FAQs for Students

Q: What is ATIPPA?

A: The Access to Information and Protection of Privacy Act (ATIPPA) is a Newfoundland and Labrador law that governs provincial public sector organizations – government departments, agencies, boards, commissions, municipalities, schools and school boards, and public post-secondary institutions. Public body is a defined term in ATIPPAATIPPA applies to records in the custody and control of the University.  Certain types of records are excluded from ATIPPA; these include questions to be included on an examination or test, and teaching materials and research information of employees of post-secondary institutions.

ATIPPA:

• gives people a right of access to records

• gives people a right of access to personal information about themselves

• gives people a right to request correction of personal information about themselves if they believe it contains an error or omission

• prevents the unauthorized collection, use and disclosure of personal information by public institutions

• provides for an independent review of decisions made by public institutions under ATIPPA

The right of access to records is subject to exceptions to disclosure. These exceptions are designed to protect information such as personal information, law enforcement activities, third party business information, and legal advice. As well, exceptions may be applied where disclosure may harm conservation or individual or public safety.  Exceptions to disclosure are set out in sections 27 to 41.

ATIPPA protects privacy by placing limits on the collection, use and disclosure of personal information. As well, public institutions are required to ensure that personal information is held securely and is accessible only by those who need access to the information in order to carry out their job responsibilities.

top


Q: What is a record?

A: Record means "a record of information in any form." It includes information that is written, photographed, recorded or stored in any manner. It includes hard copy and electronic data, including email.

Some types of records are excluded records and cannot be accessed under ATIPPA. These include court records, questions to be included on an examination or test, and teaching materials and research information of employees of post-secondary institutions.

top

Q: Who do I contact at Memorial if I have a question about my privacy or use of my personal information?

A: Rosemary Thorne
University Access and Privacy Advisor
1 Clark Place
Memorial University of Newfoundland
St. John's, NL A1C 5S7
Canada
Phone: (709)864-8214
Email: rosemaryt@mun.ca

top

Q:  Does Memorial have a policy on privacy?

A:  Yes, the Privacy policy was adopted by the Board of Regents in September 2008.  The policy contains a number of procedures relating to privacy protection.

top

Q:  Does Memorial have a policy on ATIPP requests?

A:  Yes, the Information Request policy was adopted by the Board of Regents in May 2010 and contains a number of Procedures relating to information requests.

top

For Administrative Employees

Q: What is an ATIPP request?

A: An ATIPP request is a formal request under ATIPPA for access to a record(s) at the University.  The request is made in writing, using a specific application form, and is submitted to Memorial’s IAPP Office. The University must respond, within 20 business days, unless the time limit is extended – an extension may be necessary if the request involves a large volume of records, or if the record contains information which may affect third parties, or if the request is vague. The right of access is set out in Part II of ATIPPA.

Access to records is subject to the exceptions to disclosure in ATIPPA. For example, another person’s personal information may need to be severed from a record.

ATIPP requests are subject to fees for time involved in searching, identifying and locating records and for photocopies.

top


Q: Who do I contact at Memorial if I have a question about ATIPPA?

A: Rosemary Thorne
University Access and Privacy Advisor
1 Clark Place
Memorial University of Newfoundland
St. John's, NL A1C 5S7
Canada
Phone: (709)864-8214
Email: rosemaryt@mun.ca

top

Q: Can the University release student information to a collection agency when a student has outstanding accounts?

A: Yes. ATIPPA permits disclosure for the purpose of collecting a fine or debt owed by an individual to the University.

top

Q: Is a verbal consent to use photographs for marketing purposes adequate or should waivers be signed where students are identified or identifiable?

A: The Act makes no provision for verbal consent. If the program in which the student is enrolled or participating is one where such promotion is a reasonable use of a photograph, then this use should be stated in the privacy notice provided at the time of collection. (e.g. sports teams, music programs, fine arts programs). If the promotion is not a regular part of the program, written consent should be obtained prior to use of a photograph.

top

Q: Are personal records (non-employment related) of an employee that are located on University property accessible under ATIPPA?

A: No. Generally, employees' personal records are not covered by ATIPPA. Records that relate to the operational functions of the University, are the property of the University and are covered by ATIPPA.

top

Q:  How long should job applications from unsuccessful candidates be kept?

A:  Personal information, including job applications, used to make a hiring decision must be retained for at least one year, in order to permit a candidate an opportunity to seek access to the information.  Unsolicited applications and resumes would  be retained only if they were considered in the process of a personnel search.

top

Q:  Can I use the personal information in our database for another program or purpose?

A:  Yes, but only if the purpose for the new use is substantially similar to the purpose for which the information was originally collected or compiled.  Other uses may be permitted under the ATIPPA.  Contact the IAPP Office.

top

Q:  Do I need consent in order to collect personal information?

A:  Notice is required but not consent.  When collecting personal information from a person, the university must notify the person of three things: (1) the authority for the collection; (2) the purpose for the collection; and (3 the contact information of a person who can answer questions about the collection.

top

Q:  How can I make sure personal information is kept safe when I take work home with me and on the road?

A:  First, take only the minimum personal information necessary.  If it's in paper format, ensure that it's transported in an envelope, or carrying case, or other method to prevent a "papers blowing in the wind" scenario.  Ensure the envelope or case is not left in a vehicle where it may be visible to passers-by.  If the information is in electronic format, ensure that the mobile device is encrypted.

top

Q:  If the vendor with the best solution for our new program is located in the United States, should I be worried about the U.S. Patriot Act?

A:  If the vendor will have access to personal information for which the university is responsible, the vendor/contractor must sign a privacy schedule, along with the main agreement between the vendor/contractor and the university.  If personal information will be stored outside Canada, or accessible by a person outside Canada, individuals must be advised of this fact before their personal information is collected.

top

FAQs for Academic Staff

Q: What is personal information?

A: Personal information is information about an identifiable individual. Under ATIPPA, it includes, among other things, a person’s name, address, telephone number, age, health, financial and educational information, and identifying numbers and symbols like a student number and employee number. This is not an exhaustive list. Any information about an identifiable individual is that person’s personal information, subject to limitations as set out in the ATIPPA (Section 2 of ATIPPA).

People’s opinions are also considered to be their personal information, except when the opinion is about another individual. Then, it is the personal information of the person the opinion is about (again, subject to any applicable limitations in the ATIPPA).The University holds personal information of students, faculty, staff, alumni, donors and others. Sometimes personal information may be categorized as sensitive personal information. Most often, people consider their health information to be sensitive personal information; others may feel that their personal financial information is particularly sensitive. In terms of privacy risks, like unauthorized access, credit card numbers and social insurance numbers are considered to be sensitive personal information.

Personal information is defined in Section 2 of ATIPPA. It reads:
"personal information" means recorded information about an identifiable individual, including

• the individual's name, address or telephone number,
• the individual's race, national or ethnic origin, colour, or religious or political beliefs or associations,
• the individual's age, sex, sexual orientation, marital status or family status,
• an identifying number, symbol or other particular assigned to the individual,
• the individual's fingerprints, blood type or inheritable characteristics,
• information about the individual's health care status or history, including a physical or mental disability,
• information about the individual's educational, financial, criminal or employment status or history,
• the opinions of a person about the individual, and
• the individual's personal views or opinions

top

Q:  Can employees have open access to student information?

A:  No. The fact that access to student information is possible does not imply that an employee should have access to it. Faculty and employees should have access only to personal information that they require to perform their duties as an employee of the University.

top

Q:  Will a student be able to access a letter of reference that was submitted in confidence when s/he is the subject of the information?

A:  Generally speaking, evaluative opinions are the personal information of the person being evaluated and ATIPPA allows indivduals, subject to limited and specific exceptions, a right of access to personal information about themselves.  In the case of a reference letter submitted by a writer, with the expectation that it would be held in confidence, the privacy rights of the author may limit the right of the subject to access the letter.  If a letter of reference pertains to admission to an academic program or suitablility for an award, access to the letter may be limited.

top

Q:  How do I handle privacy issues that arise when a student provides medical information in support of a request for academic accommodation?

A:  Personal information used to make a decision affecting a person is required to be retained for one year after its last use.  Medical information should be stored securely.  Unless retention of the information is needed because it directly relates to an ongoing matter (e.g., an academic appeal), secure destruction of this kind of information after one year has passed is strongly recommended.

top

Q:  How should our committee address questions about privacy protection?

A:  When committee work requires members to view and use personal information about others, they should be asked to sign a confidentiality agreement in respect of the committee work. Confidentiality agreements are strongly recommended when the committee has student and/or community membership.  Committees can use a template on the IAPP web site that may be adapted for their use.

top

Q:  Can teaching assistants and student markers take exams and papers off campus in order to grade them?

A:  If possible, grading by teaching assistants and student markers should be done on campus.

top

Q:  Can the Registrar release a student's address/phone number to a faculty member who is teaching the student?

A:  This information would be supplied only on a need to know basis. The onus is on the faculty member to show that the information is necessary.

top

Q:  Can a faculty member ask a student for personal information?

A:  Yes. A faculty member is permitted to ask a student for personal information if the information relates directly to and is necessary for an operating program or activity of the course or program. S/he would also have to inform the student of the purpose for which the information is required.

top

Q: Can student grade lists be posted?

A: Grade lists should be posted only if the department has taken reasonable precautions to assure the confidentiality of the information: these include not using names, using only the last three or four digits of student numbers, and notifying students of the method of informing them of interim grades. If a class is so small that grade holders are easily identified despite any process to conceal identities, then grade lists should not be posted.

top

Q:  How should marked exams, lab reports, and essays be distributed to students? Can they be left on a table in the hallway or in the classroom so that students can retrieve them on their own? Do they need to be returned in sealed envelopes?

A:  Section 64 of ATIPPA states that the head of a public body must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or destruction. As a result, the practice of placing graded examinations and assignments in a public place for pick up is not in keeping with privacy legislation. Examinations and assignments should be returned directly to the student. Graded assignments may be left on a desk in the classroom so that students can retrieve their own exam/assignment only if the instructor or a teaching assistant is present to supervise. Grades and comments should not be made on the cover or first page of an assignment. Ideally, graded assignments should be returned directly to the student.

top

Q:  Does e-mail correspondence received from students need to be retained for a specific length of time?

A:  The University is required to keep for one year all records used to make a decision affecting a person. If the e-mail message documents a decision or was used to make a decision and is not recorded in a more permanent format, it should be kept for one year. If the information is of temporary value or has been transcribed in a formal memo, it is considered transitory and should be retained only as long as it is required.

top

FAQs for Students

Q:  Do I have to file a formal request under ATIPPA to access information held by Memorial or information the University has about me?

A:  No. ATIPPA is in addition to and does not replace existing procedures for access to information or records. Filing an ATIPP request should be seen as an instrument of last resort. Memorial will continue to routinely provide information when requested and proactively disclose information to the community. However, when routinely and proactively disclosing information, the University must not disclose another person’s personal information or business information that could harm a third party.

top

Q: How do I file a formal ATIPP request for information?

A: Try first to access the records you are seeking through existing procedures. A formal ATIPP request should be directed to the IAPP Office. Complete the Application Form and send it to:

Daniel Furey
Access and Privacy Analyst
1 Clark Place
Memorial University of Newfoundland
St. John's, NL A1C 5S7
Canada
Phone: 709 864 8645
Email: daniel.furey@mun.ca

top


Q: How much will it cost to obtain general information?

A:  An ATIPP request for access to general records may be assessed fees in accordance with the Fee Schedule set by the Government of Newfoundland and Labrador.

top


Q: How much will it cost to obtain personal information about myself?

A: No fees are applied to your request for your own personal information.

top


Q: How long must the university keep my personal information?

A: Under ATIPPA, the university must keep personal information that has been used to make a decision affecting an individual for at least one year.

top

Q:  Will I be able to access a letter of reference that was submitted on my behalf?

A: Generally speaking, evaluative opinions are the personal information of the person being evaluated and ATIPPA allows individuals, subject to limited and specific exceptions, a right of access to personal information about themselves. In the case of a reference letter submitted by a writer with the expectation that it would be held in confidence, the privacy rights of the author may limit the right of the subject to access the letter.
If a letter of reference pertains to admission to an academic program or suitability for an award, then access to the letter may be limited.

top

Q. Can the University release information about me without my knowledge?

A: Yes, in certain circumstances.  For example, personal information could be disclosed if required by law or for law enforcement purposes, to collect a debt that you owe the university, where necessary for delivery of a program or service, and in an emergency or other compelling circumstances where a person's health or safety is at risk.

top

Share