Freedom of Information and Protection of Privacy

Home / About Us / Policies / Freedom of Information and Protection of Privacy
Category:
Governance
Audience:
University Community
Last Revised:
July 29, 2020
Owner:
President
Approved By:
Board of Governors
Contact:
Secretary to the Board(ext. 2100)

Introduction

First Nations University of Canada (FNUniv) is committed to protecting the privacy of individuals who work and study at FNUniv or who otherwise interact with FNUniv in accordance with the standards set out in The Local Authority Freedom of Information and Protection of Privacy Act (Saskatchewan) which governs the University of Regina as well as the Personal Information Protection and Electronic Documents Act (Canada).

The purpose of this Policy is to inform individuals how FNUniv fulfills that commitment as it is required to adhere to the provincial law as a federated college of the University of Regina and pursuant to the agreement that has been put in place for the sharing of Personal Information between FNUniv and the University of Regina for students that attend FNUniv.

For non-core commercial activity activities that FNUniv may engage in ( such as selling an alumni list or if Personal Information is collected for the purpose of providing a good or service such as running a parking garage or a bookstore), the Personal Information Protection and Electronic Documents Act (Canada) is the governing legislation.

This Policy applies to Personal Information and Organizational Records in the custody or under the control of First Nations University of Canada.

Definitions

Collection – means the act of gathering, acquiring, recording, or obtaining Personal Information from any source and by any means.

Consent – means an express or implied agreement to collection, use, and/or disclosure of Personal Information for defined purposes.

Commercial activity – means “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists” as defined by PIPEDA.

Disclosure – means making Personal Information available to a Third Party.

Formal Access Request – means a written request for access to Personal Information pursuant to LAFOIP.

LAFOIP –means The Local Authority Freedom of Information and Protection of Privacy Act and the Regulations thereto, in each case in effect from time to time.

Organizational Records – means all records that are prepared by of for FNUNiv for the purposes of operating FNUniv.

Personal Information – means personal information about an identifiable individual that is recorded in any form, as defined in LAFOIP or PIPEDA, as the case may be. Examples include, but are not limited to, information related to race, creed, religion, colour, sex, sexual orientation, family or marital status, disability, age, nationality, education, employment, health, identifying number, home or business address, etc.

PIPEDA – means the Personal Information Protection and Electronic Documents Actand the Regulations thereto, in each case in effect from time to time.

Privacy Breach – means an actual, alleged or suspected unauthorized collection, use or disclosure of Personal information

Privacy Legislation – means LAFOIP and PIPEDA, as applicable.

Systems – means, collectively, the University of Regina’s “BANNER” Student Module electronic information service and database, CASPUR, Web Mark Entry, Moodle and Novell.

Third Party – means a person or an entity other than (i) the individual whose Personal Information is in question, (ii) an employee of FNUniv, acting is his or her official capacity, and (iii) an employee of the University of Regina, acting is his or her official capacity.

University Official – means a person who has authority to act in an administrative capacity at FNUniv.

Policy

Members of FNUniv’s Board of Governors and all faculty and staff are responsible for the appropriate collection, access, use, disposal/archival, and disclosure of Personal Information as defined in the applicable Privacy Legislation and this Policy.

Contractors and third party service providers who receive confidential FNUniv records or personal information are also required to comply with the applicable Privacy Legislation and this Policy. This expectation will be communicated in writing in the contract that is signed with the contractor and/or third party service provider.

Protection of Privacy

  • Personal information about an identifiable individual is protected under LAFOIP and will not be used or disclosed except for the specific purpose for which it is collected or in accordance with one of the exceptions in LAFOIP or PIPEDA, as the case may be.
  • Subject to the applicable Privacy Legislation, individuals are entitled to access their own Personal Information and to request correction of their Personal Information where they believe there is an error or omission.

The University of Regina grants access to student records and files maintained by the University of Regina to the FNUniv Registrar’s Office staff who have been trained on the Systems as well as to the President, Vice-Presidents and the Department Heads of FNUniv.

Role and Responsibilities

Student records – FNUniv Registrar’s Office staff, President, Vice-Presidents and Associate Dean’s of FNUniv

The University of Regina provides access to the Personal Information of University of Regina students who are enrolled at FNUniv, and to the Systems for the following purposes:

  • Registration of students;
  • Reviewing and administering personnel and academic records of students;
  • Reviewing academic history and current registration status of students; and
  • Updating information on the Systems and in the Organizational Records pertaining only to FNUniv students.

Without the consent of both the student and the University of Regina, FNUniv shall not access any additional Personal Information or the System for any purpose not directly related to the provision of academic services to students of FNUniv and the University of Regina.

Records that contain Personal Information (i.e. personnel records)

All FNUniv Organizational Records that contain Personal Information will be protected and kept confidential. This information is to be used only for the purpose that was intended when collected and will be archived and/or disposed of according to the records management schedule that has been approved for, and is relevant to, this information.

Organizational Records

All Organizational Records are to be protected and kept confidential unless a University Official has otherwise determined to make the information public or to disclose the information. Organizational Records are not subject to LAFOIP and are not accessible through an access to information request. Organizational Records will be archived and/or disposed of according to the records management schedule that has been approved for, and is relevant to, this information.

Consequences for Noncompliance

A breach of this Policy, a breach of the Privacy Legislation or an unauthorized use or disclosure of Personal Information may have ramifications for FNUniv (and the University of Regina), which could include: legal action; financial costs; imposition of fines; and, the loss of reputation. Individuals who breach this Policy, breach the Privacy Legislation or commit an unauthorized use or disclosure of Personal Information may also be subject to disciplinary action, up to and including termination.

Violators of this Policy may be subject to penalties under FNUniv regulations, collective agreements, and under provincial and federal laws.

Processes

Process if an access to Personal Information request is received at FNUniv

  1. Any requests for access to information in the possession or control of FNUniv should be directed to the Secretary of the Board who in turn will advise the President.
  2. Access to information requests that pertain to the Organization’s Records will be denied as FNUniv is not subject to LAFOIP and these records are to remain confidential to FNUniv. If the information requested is available publicly, the Secretary of the Board will assist the request or in finding access to the information.
  3. Access to information requests that pertain to Personal Information of students should be directed to the Head, Access to Information and Protection of Privacy at the University of Regina who can facilitate responding to the request.
  4. Access to information requests that pertain to Personal Information of faculty or staff should be directed to Human Resources at First Nations University of Canada.

Process for a Privacy Breach

  1. If you become aware of a Privacy Breach involving Personal Information in the possession or control of FNUniv notify the Head of Access to Information and Protection of Privacy at the University of Regina immediately.
  2. The Head will investigate the Privacy Breach in accordance with the applicable University of Regina policies and procedures.
  3. The Head will decide who within the University of Regina and FNUniv to notify depending on the scope of the Privacy Breach.
  4. The Head, in consultation with University Officials, may take the following steps:
  1. Work with the unit to contain the Privacy Breach. This could include recovering records, making recommendations to correct weaknesses in security, etc.
  2. Notify the police if the Privacy Breach involves, or may involve any criminal activity.
  3. Notify affected individuals.
  4. Report the Privacy Breach to the Office of the Privacy Commissioner.
  5. Work with the unit to mitigate the risk of any further Privacy Breach.

Related Information

Follow Us on Instagram