Collecting Personal Information

Introduction

The purpose of this webpage is to explain how to collect personal information in accordance with the BC Freedom of Information and Protection of Privacy Act (FIPPA).

This information is provided to assist TRU faculty and staff members to understand their obligations under the FIPPA. This is not legal advice. If you have questions about the FIPPA, please contact the Privacy and Access Office at [email protected].

A. When Personal Information May be Collected

1. Under the FIPPA, you do not need an individual’s consent to collect their personal information, but you do need to have authority under the FIPPA to do so.
2. At TRU, the most commonly used authorities under the FIPPA to collect personal information include:
   

   FIPPA Section	Authority to Collection Personal Information
   Section 26(a)	The collection of the information is expressly authorized under an Act.
   Section 26(c)*	The information relates directly to and is necessary for a program or activity of TRU.
   Section 26(e)	The information is necessary for the purposes of planning or evaluating a program or activity of TRU.
   Section 26(g)	The information is collected by observation at a presentation, ceremony, performance, sports meet or similar event at which the individual voluntarily appears, and that is open to the public.

   *TRU almost always collects personal information under this authority, but it should be noted that more than one authority may apply.

3. When collecting personal information under section 26(c), TRU needs to be able to demonstrate that the collection is “necessary”, and is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection. If you are not sure whether you are authorized to collect personal information in a given situation, please contact the Privacy and Access Office for assistance.

B. When Collecting Personal Information

1. When collecting personal information from an individual the individual must be told:
   1. The purpose for collecting it;
   2. The legal authority for collecting it; and,
   3. The title, business address, and phone number of an employee of TRU who can answer questions about the collection of their personal information.
   This is called a Privacy Notification.

C. Privacy Notification

1. The Privacy Notification should be in writing and should be prominently displayed on the form or webpage you are using to collect personal information. It is not necessary for individuals to sign or initial the privacy notification.
2. Following is the TRU standard form template to be used for TRU Privacy Notifications:
   Privacy Notification – ______(i)__________
   Thompson Rivers University (TRU) collects, uses, discloses and retains personal information in compliance with the BC Freedom of Information and Protection of Privacy Act (FIPPA).
   Your personal information is being collected and will be used for the purposes of ______(ii)_________, or for purposes consistent with these uses. The collection of this information is permitted under section _______(iii)________ of the FIPPA. This information will be retained in accordance with TRU’s Records Retention/Destruction Policy.
   Questions about the collection of this information may be directed to _____(iv)___________ at ____(v)______, _____(vi)[email protected]. or by post to: ______(vii)___________, 805 TRU Way, Kamloops, BC, V2C 0C8. Alternatively you may contact the Privacy Office at [email protected].
   Key:
   
   1. Name of the initiative.
   2. In this space describe in detail the purposes for collecting the personal information. If the personal information will be made public it should be stated here.
   3. Enter the section of the FIPPA that provides the general legal authority for collecting personal information.
   4. Contact information for an employee in the department who can answer questions about the collection.
3. Under s.27(1) of FIPPA, public bodies must collect personal information directly from the individual the information is about, subject to exceptions*. If you wish to collect information indirectly (e.g. conducting reference checks of a job applicant), you can do so by getting authorization from the individual the information is about.
   1. Indirect collection may be permitted where it is necessary for medical treatment (and it is not possible to collect it directly), where another enactment authorizes it, where it relates to a court proceeding, etc. Section 27(1) can be viewed here: Freedom of Information and Protection of Privacy Act
   2. Please contact [email protected] for assistance with the above.

D. Privacy Notification and Consent

1. There are situations when TRU must also obtain the consent of individuals for the use or disclosure of their personal information as described in the FIPPA. For example, if the personal information will be used for a "new" purpose from when it was originally collected.
2. Under FIPPA section 32, a public body may only use personal information in its custody/under its control for the purpose the information was obtained, or for a use consistent with that purpose.
3. The individual the information is about can also consent to their personal information being used for a new purpose.
4. If consent is required, a consent mechanism should be included with the Privacy Notification. The consent must include:
   1. a complete listing of the personal information involved,
   2. for what purposes it will be used or disclosed,
   3. to whom it will be disclosed to by TRU (if applicable),
   4. the jurisdiction to which the personal information may be disclosed (if possible), and
   5. the date the consent is signed and, if applicable, when the consent expires.
5. The consent requires an affirmative action by the individual and must be freely given (with no penalty).
6. TRU must manage all consents in compliance with TRU's Records Retention Schedule.
7. Please note that while consent is no longer required where information is to be stored/accessed outside of Canada, where information that is sensitive will be stored outside Canada, FIPPA requires an additional assessment of this disclosure. Please see the section below on Privacy Impact Assessments for more information.

Please contact the Privacy Office with any questions you may have about when consent is required.