Executive Leadership Team, June 10, 2016
September 7, 2004
The objectives of this policy are:
- To ensure that TWU operates in compliance with the Personal Information Protection Act.
- To ensure that the people served by the University may be confident that the University treats their private, personal information with appropriate care.
- To ensure that TWU employees have a policy to guide their actions and decisions related to the confidentiality and security of personal information in the custody of TWU.
Scope of this Policy:
We believe that ensuring the accuracy, confidentiality, and security of the personal information we hold about our constituents is more than simply a legal requirement, it is an ethical obligation.
This policy is based on the Personal Information Protection Act, S.B.C. 2003, c.63 (PIPA), adapted to meet the specific needs and expectations of our constituent base.
This policy applies to Trinity Western University. It outlines the principles and commitments we make to protect the privacy of personal information in TWU’s possession or control. The individual responsible for ensuring that TWU complies with PIPA and applies this policy is set out at the bottom of this policy.
TWU is responsible for the protection of personal information in its custody or under its control. While senior management is ultimately accountable for the protection of personal information, the day-to-day monitoring for compliance may be delegated to other staff.
The overall responsibility for the protection of personal information, and compliance with this policy and PIPA rests with TWUs Privacy Officer, whose contact information is indicated at the end of this policy.
TWU is committed to ensuring that the reasonable security measures are in place to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal of personal information (or similar risks). However, when using e-mail or wireless communication, TWU advises constituents that complete confidentiality and security are not assured. TWU is not accountable for any damages suffered when a constituent transmits personal information through regular e-mail or wireless communication or when TWU transmits information at the request of the constituent.
TWU has developed policies and procedures to: protect personal information; receive and respond to complaints and inquiries; and communicate the policies and procedures to our constituents.
Identifying the Purposes of Personal Information
Where required by PIPA, TWU will communicate the purposes for which personal information is being collected, used or disclosed, either orally or in writing, unless the purpose would be considered to be obvious to a reasonable person at the time he or she provides the personal information to TWU.
TWU may also collect, use or disclose personal information for purposes specified (or obvious to a reasonable person) if:
- TWU provides the individual with a notice, in a form the he or she can reasonably be expected to understand, that it intends to collect, use or disclose the individual's personal information for those purposes
- TWU gives the individual a reasonable opportunity to decline within a reasonable time to have his or her personal information collected, used or disclosed for those purposes,
- the individual does not decline, within the time allowed under paragraph (1), the proposed collection, use or disclosure, and
- the collection, use or disclosure of personal information is reasonable having regard to the sensitivity of the personal information in the circumstances.
TWU collects, uses and where appropriate discloses constituent personal information for a variety of reasons, including the following:
- To assess the academic and other qualifications of applicants for admission;
- To efficiently and accurately enrol students;
- To assess the qualifications and suitability of applicants for employment;
- To employ and manage staff and faculty;
- To develop and manage services to meet the needs of our constituents;
- To contact our constituents directly for services that may be important to the completion of their potential or actual education or employment or to provide or offer added benefits to them as students, alumni, donors or employees;
- To assess academic performance of students and other matters relevant to a student’s enrolment at TWU or participating in the TWU community;
- To determine the eligibility of our constituents for different services;
- To ensure a high standard of service to our constituents;
- To meet regulatory requirements;
- To fundraise for or on behalf of TWU;
- To verify a constituents identity or other information that is important or necessary for the consideration of enrolment or employment, or for the management of student, employee or other constituent relations with TWU.
TWU will, when required by this policy or PIPA, obtain constituent consent to collect, use or disclose any personal information. TWU will make reasonable efforts to ensure that constituents understand how their personal information will be used and disclosed.
Express consent may be given orally, in writing, or electronically. For example, depending on the sensitivity of the information, consent can be expressed over the telephone when information is being collected; electronically when submitting an agreement, application, or other information; in writing when signing an agreement or application form, when using a service, or when indicating by means of a check-off box whether or not consent is granted. Implicit consent may arise in any way permitted in PIPA or as further set out in this policy (although nothing in this policy should be read to permit TWU to breach its mandatory obligations under PIPA).
Subject to contractual or legal arrangements, or TWU’s right to use or disclose personal information under PIPA, constituents may withdraw or refuse consent provided that TWU is given reasonable written notice. Refusal or withdrawal of consent may prevent TWU from providing services to the constituent. TWU will not as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.
Collection, USE AND DISCLOSURE of Personal Information Without Consent
TWU may collect, use and/or disclose personal information about an individual without consent (including collection from a source other than the individual) as permitted by PIPA, which includes the following:
(a) the collection, use and/or disclosure is clearly in the interests of the individual and consent cannot be obtained in a timely way,
(b) the collection, use and/or disclosure is necessary for the medical treatment of the individual and the individual is unable or does not have the legal capacity to give consent,
(c) it is reasonable to expect that the: (i) collection with the consent of the individual would compromise the availability or the accuracy of the personal information; (ii) use or disclosure with the consent of the individual would compromise an investigation or proceeding; and the collection, use or disclosure (as applicable) is reasonable for purposes related to an investigation or a proceeding,
(d) the personal information is collected by observation at a performance, a sports meet or a similar event
(i) at which the individual voluntarily appears, and
(ii) that is open to the public,
(e) the personal information is available to the public from a source prescribed by regulation for the purposes of paragraphs.12(e), 15(e) and/or 18(e) of PIPA, as applicable,
(f) the collection, use and/or disclosure is necessary to determine the individual's suitability
(i) to receive an honour, award or similar benefit, including an honorary degree, scholarship or bursary, or
(ii) to be selected for an athletic or artistic purpose,
(g) the organization is a credit reporting agency that collects or uses the personal information to create a credit report and the individual consents at the time the original collection takes place to the disclosure for this purpose,
(h) the collection, use and/or disclosure is required or authorized by law,
(i) the information was disclosed to the organization under sections 18 to 22 of PIPA or the disclosure to a third party is authorized by PIPA, or
(j) the collection, use or disclosure personal information is necessary to facilitate
(i) the collection of a debt owed to TWU, or
(ii) the payment of a debt owed by TWU.
As permitted by PIPA, TWU may also use and/or disclose personal information in urgent or emergent circumstances when:
(a) the use is necessary to respond to an emergency that threatens the life, health or security of an individual;
(b) the use is necessary for medical treatment and a person does not have the capacity to give consent at the time;
(c) disclosure is for the purpose of contacting next of kin or or a friend of an injured, ill or deceased individual; or
(d) there are reasonable grounds to believe that other compelling circumstances exist that affect the health and safety of any individual, in which case notice of the disclosure will be mailed to the last known address of the individual to whom the personal information relates.
TWU may collect personal information from or on behalf of another organization, use personal information collected from or on behalf of another organization, or disclose personal information to another organization without consent of the individual to whom the information relates, if
(a) the individual previously consented to the collection of the personal information by TWU or the other organization (as applicable), and
(b) the personal information is used by, disclosed to or collected by TWU solely
(i) for the purposes for which the information was previously collected, and
(ii) to assist that organization or TWU (as applicable) to carry out work on behalf of the other organization.
Limits for Collecting Personal Information
TWU will only collect personal information for the purposes identified and as may otherwise be permitted by PIPA. TWU will use methods for the collection of information that are lawful.
Other Uses and Disclosure of Personal Information TWU will not sell constituent lists or personal information to Third Parties and will not disclose personal information except as contemplated in this policy or permitted under PIPA .
TWU may periodically use constituent personal information to conduct constituent surveys in order to enhance the provision of services from TWU. If an outside body is employed to conduct research on behalf of TWU, or provide other services that require access to constituent information, TWU will ensure that reasonable security measures, such as confidentiality clauses in contractual arrangements, are employed to protect the transfer and use of personal information.
TWU is a single organization. Subject to applicable law, each business unit within TWU may transfer personal for uses or disclosure permitted under this policy or PIPA.
Retention of Personal Information
TWU will retain constituent personal information only as long as necessary or expected to be necessary for the identified purposes, or as required by legislation. TWU will retain personal information for at least one year if it used that personal information to make a decision the directly affects an individual. TWU will destroy documents containing personal information, or remove the means by which personal information can be associated with particular individuals, as soon as it is reasonable to assume that the purpose for which the information was collected is no longer being served by the retention of the personal information and retention is no longer necessary for legal or business purposes.
TWU will make reasonable efforts to ensure that personal information is as accurate, complete, and current as required for the purposes for which it was collected. In some cases, TWU relies on its constituents to ensure that certain information, such as their address, telephone number or other contact information, is current, complete, and accurate.
TWU will not routinely update information unless it is necessary to fulfill the purposes for which it was collected or if it is required to maintain active constituent information.
Individuals may request amendments to the records at TWU in order to ensure the accuracy and completeness of their personal information. If the amendment request pertains to information that remains in dispute, TWU will note the individual’s opinion in the file.
Safeguarding Personal Information
TWU is committed to ensuring that the reasonable security measures are in place to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal of personal information (or similar risks).
Depending on the sensitivity of the information, TWU will employ reasonable security measures to protect the information. The measures may include, for example, the physical security of offices and data servers, and electronic security measures such as passwords, encryption, and personal identification numbers.
TWU will use reasonable security measures when disposing of constituent personal information.
The development of TWU policies and procedures for the protection of personal information is an ongoing process. Changes in technology may require TWU to develop, update, and review information protection guidelines and controls to reasonably protect the security of personal information.
Availability of Policies and Procedures
TWU is open about its policies and practices related to personal information. Information about these policies and practices will be made available to constituents either electronically or in written format in plain language on request. However, to ensure the integrity of our security procedures and business methods, TWU may refuse to publicly disclose certain information as permitted by PIPA.
The person designated by TWU to be responsible for ensuring that TWU complies with PIPA and this policy is its privacy officer, whose name and contact information is at the end of this policy.
Providing Constituent Access to Personal Information
Constituents and other individuals have a right to access their personal information held by TWU, subject to the limitations and permitted restrictions in PIPA. Upon request, TWU will, within a reasonable time period, tell the constituent or other individual what personal information it has, for what it is being used, and to whom it has been disclosed if applicable and within the time period for which records are available. TWU is not required to disclose personal information or other information in a number of circumstances permitted by PIPA, including when it is protected by solicitor-client privilege, when it could reveal confidential commercial information or when it would reveal personal information of a third party.
When making a request for access to personal information held by TWU, constituents may be asked to be specific about the information they would like to access and to submit their request in writing to their contact at TWU.
Constituents will be required to provide personal information to identify them to enable TWU to provide an account of the existence, use, and disclosure of personal information.
TWU will generally make the information available within 30 business days, or will provide written notice of extension where additional time is required to fulfill a request.
When information is not provided within 10 business days of the request, TWU will, no later than 30 business days after the date of the request, send a notice of extension, advising of the new time limit, the reasons for extending the time limit and the right of the constituent to make a complaint to the Privacy Commissioner of British Columbia regarding the extension.
If a request is refused, TWU will notify the constituent in writing, documenting the reasons for refusal and resources for redress available to the constituent.
In certain situations, TWU may not be able to provide access to any or all personal information about a constituent. In such cases, TWU will explain the reasons it will not provide the requested information, and identify resources for recourse available to the constituent. The reasons for not providing information may include that it is unreasonably costly to provide, the information would threaten the life or security of another individual, the information was generated in a formal dispute resolution process, the information contains references to other individuals, or the information cannot be disclosed for legal reasons, security purposes, or is subject to solicitor-client or litigation privilege.
If the information is demonstrated to be inaccurate or incomplete, TWU will amend the information as required. Where appropriate, TWU will transmit the amended information to Third Parties having access to the information in question.
Compliance and Complaints
Trinity Western University
7600 Glover Road
Langley, BC V2Y 1Y1
Attention: The Privacy Officer (Grant McMillan)
"Collection" - the act of gathering, acquiring, or obtaining personal information from any source, including third parties, by any means.
"Consent" - involves agreement with what is being done or proposed and includes any form of consent permitted to be obtained, either expressly or implicitly, under PIPA. Without limiting the applicability to PIPA, express consent can be given orally or in writing, it is unequivocal. Implicit consent exists when TWU can reasonably infer consent based upon the action or inaction of the individual, and includes implicit consent recognized under PIPA.
"Constituent" - is any individual who attends, or applies, or works and submits, and commits to participate in any way with TWU (may be employee, student, donor, affiliate organization, parent of student, supplier, etc.)
"Disclosure" - the act of making personal information available to Third Parties who may or may not be associated with TWU.
"Use" – includes the treatment or handling of personal information by and within TWU or the reliance on personal information by TWU to make any decision or determination.
"Personal Information" - information about an identifiable individual that is recorded in any form; excluding the individual's name, business title, business address, and business phone number.
"Third-Party" - an individual or organization other than TWU and the individual.
TWU - Trinity Western University
All other terms and phrases that are defined in PIPA will be given the same definition in this policy as in PIPA.
The Privacy Officer will report on compliance with this policy to the Executive Leadership Team on an annual basis, or more frequently as needed.