Personal Information: Collection, use and disclosure
1.1 Purpose
On November 23, 2000, the Nova Scotia Freedom of Information & Protection of Privacy Act, (hereafter FOIPOP), was amended to include all records in the care and custody of Nova Scotian universities. As of this date, university records are considered public records. The FOIPOP Act ensures that public bodies, including universities, are accountable to the public, that the public has a right to have access to records, the right to the correction of personal information about themselves, and the right to question the unauthorized collection, use, or disclosure of personal information. St. Francis Xavier University is committed to the appropriate collection, use, and disclosure of general and personal information in accordance with the FOIPOP Act.
1.2 Scope and responsibility
Many StFX employees are required to collect, use, and disclose general and personal information during their employment with the University. These are required to have an understanding of the FOIPOP Act and its implications, especially in regard to the collection, use, and disclosure of personal information. These policies apply to all StFX employees. Disciplinary action may result if these policies are not followed.
1.3 Definition
According to the FOIPOP Act personal information is defined as:
- the individual's name, address or telephone number,
- the individual's race, national or ethnic origin, colour, or religious or political beliefs or associations,
- the individual's age, sex, sexual orientation, marital status or family status,
- an identifying number, symbol or other particular assigned to the individual,
- the individual's fingerprints, blood type or inheritable characteristics,
- information about the individual's health-care history, including a physical or mental disability,
- information about the individual's educational, financial, criminal or employment history,
- anyone else's opinions about the individual, and
- the individual's personal views or opinions, except if they are about someone else.
2. Policies
2.1 Collection
Personal information is not permitted to be collected unless the information directly relates to University activities or is necessary for the enactment of a University program or activity. Personal information is not permitted to be collected, used, or disclosed for the personal use or benefit of University employees.
2.2 Use
Personal information must only be collected for the purpose for which that information was obtained or compiled, or for a use compatible with that purpose.
2.3 Security
All University records are to be housed and maintained in a secure location to prohibit unauthorized access, use, or disclosure. All records (regardless of media) are to be kept in secure enclosures (i.e. locked filing cabinets or password protected automated systems, etc.) To protect the confidentiality of the records, all reasonable measures should be undertaken. Only those University employees who require access to the information are to be granted admittance to it. Confidential records are to be identified as such and are not to be filed with general records. One person should be designated for each office/department and will have the ultimate responsibility for the records.
2.4 Correction of errors and/or omissions
An individual may make application to have errors or omissions corrected in regard to personal information about them. Upon making a request the University will correct and annotate information with an amendment, when satisfactory documentary evidence is provided to support the correction.
2.5 Disclosure
StFX employees may disclose personal information within the University (i.e. from office to office) if the information is necessary to perform necessary University activities. Individuals are to be notified upon collection of the information that personal information may be shared within the University for work related matters but not to outside third parties without written consent, or upon exemptions in the FOIPOP Act. University personnel may release personal information about any individual; if the individual has consented in writing to its disclosure, for a use compatible with the original purpose for which it was obtained or compiled, for the purposes of complying with a subpoena, warrant, or summons; for the collecting of a debt owed to the University, or for the making of a payment to the University, to the representative of the bargaining agent authorized in writing by the employee, to an officer/employee of the University when it is necessary for the performance of duties, for the protection of the health or safety of University personnel, for the necessary requirements of University operation or law enforcement, so that the next of kin/friend of an injured, ill or deceased individual may be contacted, and/or if the President of the University (or prescribed representation) determines that compelling circumstances exist that affect anyone's health or safety.
2.6 Disclosure for research purpose
St. Francis Xavier University may disclose personal information for a research purpose, including statistical research. This information is only permitted if the research cannot reasonably be undertaken unless that information is made available in individually identifiable form. This can only be undertaken if any record linkage is not harmful to the individuals that information is about and that the benefits derived will be clearly in the public interest, the President of the University (or prescribed representative) has approved conditions relating to the security and confidentiality and the removal or destruction of individual identifiers, the prohibition of any subsequent use/disclosure of that information in individually identifiable form without the express authorization of the University, and the person to whom that information is disclosed has signed an agreement complying with approved conditions regarding that act and with the University's policies.
