Because of federal legislation that went into effect at the beginning of the year, University administrators are taking a careful look at how they handle private details they collect from the people who work and study here. The Personal Information Protection and Electronic Documents Act (PIPEDA) sets out guidelines for how organizations gather and use such material.
However, the act, which has been in force for federally regulated organizations since 2001, refers specifically to information gathered through commercial activities. That stipulation promises to complicate life for people examining the matter at the University, which represents a diverse combination of commercial and non-commercial interactions.
In fact, different parts of the institution collect a wide range of details. The bookstore might have records of your reading habits, sport services might have tracked your workout times, and health services might have even more intimate aspects of your life on file. That’s not to mention closely guarded administrative material, such as transcripts of an individual’s academic performance.
“The group here decided that at least in spirit, we would apply it throughout the system,” said Pierre-Yves Boucher, secretary of the University, who is overseeing compliance with PIPEDA. “We decided that we would apply the same rules to everything.”
That means asking various units on campus to designate privacy officers to take stock of how private information is being handled. Their feedback will help to frame a declaration on privacy that will ultimately be posted on the University’s Web site and elsewhere.
Besides helping each unit determine whether it is acting in accordance with the legislation, this process will ensure that the declaration is something that does not interfere with necessary work.
Boucher offers alumni services as an especially prominent example. Just as commercial enterprises have been notifying their clients of the personal information they collect and offering them the option of denying its use, so too will the University be mailing out similar notices to alumni. But because the University collects much of this information for educational or research purposes, adds Boucher, expectations are somewhat different.
“Most people who attend the University take it for granted that their records will end up at the alumni association to try and develop an affinity between the institution and its graduates,” he said.
The University will also caution alumni that by opting out of the sharing of information, they may not be able to receive some of the personalized services they might otherwise be offered. Nevertheless, the choice remains with the person who provided the information in the first place.
Even as administrators come to grips with PIPEDA, though, its precise interpretation is still being considered. Agencies such as the Council of Ontario Universities and the Association of Universities and Colleges of Canada, for example, have yet to provide a final determination on how closely the legislation should be observed.
In fact, Boucher points out, professionals such as lawyers, accountants, and consultants have not come forth with their own position on the matter. The University and the hospital are therefore further ahead than most institutions that are not federally regulated.
“What’s important is for people not to panic,” he said. “The legislation was not intended to become a way to prevent normal, useful business practices from functioning.”
