SEPTEMBER 7, 2004 VERSION
APPROVED BY PRESIDENTS CABINET ON SEPTEMBER 15, 2004
We believe that ensuring the accuracy, confidentiality, and security of the information we hold about our constituents is more than simply a legal requirement, it is an ethical obligation.
This policy is based on Bill 38- the Personal Information Protection Act (PIPA). We have adapted the provincial government standards to our organization in order to meet the specific needs and expectations of our constituent base.
This policy applies to Trinity Western University. It outlines the principles and commitments we make to you to protect the privacy of your personal information.
"Collection" - the act of gathering, acquiring, or obtaining personal information from any source, including third parties, by any means.
"Consent" - involves voluntary agreement with what is being done or proposed. Consent may be expressed or implied. Express consent can be given orally or in writing, it is unequivocal, and does not require any inference on the part of TWU. Implied consent exists when TWU can reasonably infer consent based upon the action or inaction of the constituent.
"Constituent" - is any individual who attends, or applies, or works and submits, and commits to participate in any way with TWU (may be employee, student, donor, affiliate organization, parent of student, supplier, etc.)
"Disclosure" - the act of making personal information available to third parties who may or may not be associated with TWU.
"Use" - the treatment and handling of personal information by and within TWU.
"Personal Information" - information about an identifiable individual that is recorded in any form; excluding the individual's name, business title, business address, and business phone number.
"Third-Party" - an individual or organization other than TWU and the constituent.
TWU Trinity Western University
TWU is accountable for the protection of constituent personal information. While senior management is ultimately accountable for the protection of personal information, the day-to-day monitoring for compliance may be delegated to other staff.
The overall responsibility for the protection of personal information, and compliance with this policy rests with TWUs Privacy Officer.
TWU is committed to ensuring that the appropriate security measures are employed in the transfer of sensitive personal information. However, when using e-mail or wireless communication, TWU advises constituents that complete confidentiality and security are not assured. TWU is not accountable for any damages suffered when a constituent transmits personal information through regular e-mail or wireless communication or when TWU transmits information at the request of the constituent.
TWU has developed policies and procedures to: protect personal information; receive and respond to complaints and inquiries; and communicate the policies and procedures to our constituents.
Identifying the Purposes of Personal Information
TWU will communicate the purposes for which information is being collected, either orally or in writing.
TWU collects constituent personal information for the following reasons only:
- To efficiently and accurately enrol students to our academic institution;
- To employ staff and faculty
- To develop and manage services to meet the needs of our constituents;
- To contact our constituents directly for services that may be important to the completion of their education or added benefits to them as students, alumni, donors or employees:
- To determine the eligibility of our constituents for different services;
- To ensure a high standard of service to our constituents;
- To meet regulatory requirements;
- To verify a constituents identity.
TWU will obtain constituent consent to collect, use or disclose any personal information except where detailed in this policy. TWU will make reasonable efforts to ensure that constituents understand how their personal information will be used and disclosed.
Consent may be given orally, in writing, or electronically. For example, depending on the sensitivity of the information, consent can be expressed over the telephone when information is being collected; electronically when submitting an agreement, application, or other information; in writing when signing an agreement or application form, when using a service, or when indicating by means of a check-off box whether or not consent is granted.
Subject to contractual or legal arrangements, constituents may withdraw or refuse consent provided that TWU is given reasonable notice. Refusal or withdrawal of consent may prevent TWU from providing service to the constituent. TWU will not unreasonably withhold services from constituents who refuse or withdraw consent, but if information is required by law or required to fulfill our obligation, TWU may decline to deal with a constituent or person who will not consent to the use of such information.
COLLECTION OF PERSONAL INFORMATION WITHOUT CONSENT
TWU may collect personal information about an individual without consent or from a source other than the individual, if
(a) the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way,
(b) the collection is necessary for the medical treatment of the individual and the individual is unable to give consent,
(c) it is reasonable to expect that the collection with the consent of the individual would compromise the availability or the accuracy of the personal information and the collection is reasonable for an investigation or a proceeding,
(d) the personal information is collected by observation at a performance, a sports meet or a similar event
(i) at which the individual voluntarily appears, and
(ii) that is open to the public,
(e) the personal information is available to the public from a source prescribed for the purposes of this paragraph,
(f) the collection is necessary to determine the individual's suitability
(i) to receive an honour, award or similar benefit, including an honorary degree, scholarship or bursary, or
(ii) to be selected for an athletic or artistic purpose,
(g) the organization is a credit reporting agency that collects the personal information to create a credit report and the individual consents at the time the original collection takes place to the disclosure for this purpose,
(h) the collection is required or authorized by law,
(i) the information was disclosed to the organization under sections 18 to 22, or
(j) the personal information is necessary to facilitate
(i) the collection of a debt owed to the organization, or
(ii) the payment of a debt owed by the organization.
TWU may collect personal information from or on behalf of another organization without consent of the individual to whom the information relates, if
(a) the individual previously consented to the collection of the personal information by the other organization, and
(b) the personal information is disclosed to or collected by the organization solely
(i) for the purposes for which the information was previously collected, and
(ii) to assist that organization to carry out work on behalf of the other organization.
Limits for Collecting Personal Information
TWU will only collect personal information for the purposes identified. TWU will use methods that are lawful and will not collect information indiscriminately.
Limits for Using, Disclosing, and Keeping Personal Information
Constituent information will only be used or disclosed for the purpose for which it was collected. TWU will not use personal information for any additional purpose unless TWU seeks constituent consent to do so.
TWU will not sell constituent lists or personal information to Third Parties.
TWU may periodically use constituent personal information to conduct constituent surveys in order to enhance the provision of services from our institution. If an outside body is employed to conduct research on behalf of TWU, or provide other services that require access to constituent information, TWU will ensure that appropriate security undertakings, such as confidentiality clauses in contractual arrangements, are employed to protect the transfer and use of personal information.
Subject to applicable law, each business unit within TWU may transfer information between each other.
TWU will retain constituent personal information only as long as necessary or expected to be necessary for the identified purposes, or as required by legislation.
TWU will make reasonable efforts to ensure that constituent personal information is as accurate, complete, and current as required for the purposes for which it was collected. In some cases, TWU relies on its constituent to ensure that certain information, such as the constituents address or telephone number, is current, complete, and accurate.
TWU will not routinely update information unless it is necessary to fulfill the purposes for which it was collected or if it is required to maintain active constituent information.
Constituents may request amendments to the records at TWU in order to ensure the accuracy and completeness of their personal information. If the amendment request pertains to information that remains in dispute, TWU will note the constituents opinion in the file.
Safeguarding Personal Information
TWU is committed to the safekeeping of constituent personal information in order to prevent its loss, theft, or unauthorized access, disclosure, duplication, use, or modification.
Depending on the sensitivity of the information, TWU will employ appropriate security measures to protect the information. The measures may include, for example, the physical security of offices and data servers, and electronic security measures such as passwords, encryption, and personal identification numbers.
TWU will use appropriate security measures when disposing of constituent personal information.
The development of TWU policies and procedures for the protection of personal information is an ongoing process. Changes in technology necessitate that TWU continually develop, update, and review information protection guidelines and controls to ensure ongoing information security.
Availability of Policies and Procedures
TWU is open about the policies and procedures it uses to protect constituent personal information. Information about these policies and procedures will be made available to constituents either electronically or in written format in plain language. However, to ensure the integrity of our security procedures and business methods, TWU may refuse to publicly disclose certain information.
TWU will make the following information available:
- The name, title and address of the person accountable for the policies and procedures and to whom complaints or inquiries can be forwarded;
- A description of the type of personal information held by TWU, including a general account of its use;
- A copy of any brochures or other information that explain the policies and procedures; and
- An explanation of what personal information is made available to related organizations.
Providing Constituent Access to Personal Information
Constituents have a right to access their personal information held by TWU. Upon request, TWU will, within a reasonable time period, tell the constituent what personal information it has, for what it is being used, and to whom it has been disclosed if applicable and within the time period for which records are available.
Constituents may be asked to be specific about the information they would like to access and to submit their request in writing to their contact at TWU.
Constituents will be required to provide personal information to identify them to enable TWU to provide an account of the existence, use, and disclosure of personal information.
TWU will make the information available within 10 business days, or provide written notice of extension where additional time is required to fulfill the request.
When information is not provided within 10 business days of the request, TWU will, no later than 10 business days after the date of the request, send a notice of extension to the constituent, advising of the new time limit, the reasons for extending the time limit and the right of the constituent to make a complaint to the Privacy Commissioner of British Columbia regarding the extension.
If a request is refused, TWU will notify the constituent in writing, documenting the reasons for refusal and resources for redress available to the constituent.
In certain situations, TWU may not be able to provide access to any or all personal information about a constituent. In such cases, TWU will explain the reasons it will not provide the requested information, and identify resources for recourse available to the constituent. The reasons for not providing information may include that it is unreasonably costly to provide, the information would threaten the life or security of another individual, the information was generated in a formal dispute resolution process, the information contains references to other individuals, or the information cannot be disclosed for legal reasons, security purposes, or is subject to solicitor-client or litigation privilege.
If the information is demonstrated to be inaccurate or incomplete, TWU will amend the information as required. Where appropriate, TWU will transmit the amended information to Third Parties having access to the information in question.
Compliance and Complaints
Trinity Western University
7600 Glover Road
Langley, BC V2Y 1Y1
Attention: The Privacy Officer (Grant McMillan)