Policy Details

2000-7-1 Confidentiality & Privacy of Information & Records

Responsible Executive Senior Vice-President, Strategy & Corporate Services
Director, Human Resources
Issue Date April 18, 2013
Supersedes Date October 4, 2016
Last Review August 30, 2023
Last Revision August 30, 2023

Upon request, the college will provide a copy of this policy in an alternate format.

Lambton College gathers, generates and stores information concerning its students, employees and persons who use services provided by Lambton College. The information may be comprised of personal information, including academic, employment, financial and health records. In addition, in the course of its interactions with business and government partners, suppliers and other third parties, Lambton College comes into the possession of third party information, including information that is confidential in nature.

As the holder of the information and records, the College has a responsibility and legal obligation to collect, use, disclose, retain and dispose of the records and information with appropriate safeguards and in a manner that protects their confidentiality and respects the privacy of individuals. In meeting its obligations and responsibilities, the College complies with all applicable laws, including the Freedom of Information and Protection of Privacy Act (“FIPPA”) and the Personal Health Information Protection Act (“PHIPA”).

Policy

Confidentiality and Privacy

  1. Information collected in student records (e.g. academic, discipline, financial, health, financial aid), in employee records and concerning persons using Lambton College services will be used to administer the student programs, activities and services of the College, manage the Human Resources department functions and deliver employee benefits and services, and generally administer the College.
  2. Information provided to the College by business and government partners, suppliers and other third parties will be used to achieve the business and other goals of the College, consistent with the purposes for which the information is provided to the College.
  3. All Lambton employees are responsible and accountable for maintaining the confidentiality and privacy of all records containing personal or confidential information, and for compliance with this policy when working with and having access to confidential records and personal information.
  4. The College will use organizational processes and security protocols to ensure the integrity, privacy and confidentiality of the information in its records. The administrator, at the director or dean level, of the department that stores or uses the personal information and confidential records shall be responsible and accountable for the implementation and operation of processes and protocols that ensure the confidentiality of the records and information, and the privacy of the individuals. Specifically, but not exhaustively, responsibility for the privacy and confidentiality of student and financial aid records rests with the Registrar; for student health records, with the Associate Vice-President, Student Success; for financial records, with the Director of Finance; for employee records with the Director, Human Resources; for video surveillance recordings and other security related information with the Director of Facilities; and for classroom and laboratory student recordings with the relevant Dean.
  5. Records and personal information concerning a student or employee will be used or disclosed only by those College employees, consultants or agents authorized to access those records or information for the conduct of College business, or as otherwise permitted or required by law or as authorized in this Policy.
  6. Personal information or confidential records may be released only by the administrator responsible for the information and records as described above, or their designate. (e.g.  Only the Registrar may release information concerning students and their registration status or grades.) Where access to information is sought under FIPPA or PHIPA, the responsible administrator shall refer the matter to the designated position of the College.
  7. Public Information concerning a student consists of: name of graduate, credential granted, date credential was granted, awards given and date the awards were given. Public Information concerning an employee arises from the employment role and consists of name, title, work address, work telephone number and work e-mail address.
  8. The posting of any student grade or evaluation result by student name, student number or any other identifying symbol or code is strictly prohibited unless the posting is in a manner that does not lead to the identification of the individual.
  9. A list of student names or the student directory will not be released except for use within the College, for example, to administer Student Administrative Council (SAC) elections.
  10. The College will publish an information statement (see appendix A) describing its collection and use of student information and provide an avenue for students to seek additional information or note concerns regarding the gathering and use of the information.
  11. The College may use video surveillance cameras on College property for the purpose of ensuring the safety and security of students, employees and campus visitors, and the security of College facilities and property.  The video records will be considered confidential and subject to the provisions of FIPPA and this policy.
  12. Student and employee information and records will be retained as described in the Records Retention (1000-1-3) policy.

Student or Employee Access to Information

  1. Subject to sections 17 through 24 of this policy, students or employees, upon written request and verification of identification, shall:
    1. be given access to their own files;
    2. be able to release all or part of the file to a third-party; or
    3. be able to request that the file be held with no release allowed.
  2. Students or employees may have access to their own files, but may not alter or remove any of the contents.
  3. Where individuals are granted access to their own files and disagree with the content of the record or file, they may, in writing, request the correction of the information or require that a statement of disagreement be attached to the information where correction is refused. Any statement of disagreement will then be considered a part of the file.
  4. The College may hold back the release of a student's record, to the student or a third-party, if there are debts outstanding to the College.

Exemptions to Access to Information

  1. Access to information in the custody or control of the College is governed by the provisions of FIPPA and PHIPA. When considering any request to access personal information or confidential information, the College will apply the statutory exemptions as appropriate.
  2. The following are illustrative of some of the relevant exemptions:
    1. The disclosure could be reasonably expected to interfere with a law enforcement or legal matter, or an ongoing internal investigation;
    2. The disclosure would reveal information received in confidence from another government body or its agencies;
    3. The information was supplied in confidence, and is evaluative or opinion material compiled for such purposes as assessing the teaching materials or research of an individual, determining suitability or eligibility of qualifications for admission to a program, determining suitability for an honour or award, or determining suitability, eligibility or qualifications for the awarding of contracts or employment or other benefits, and where the disclosure would reveal the identity of the source who furnished information to the College in circumstances where it was explicitly stated or may reasonably have been assumed that the identity of the source would be held in confidence;
    4. The disclosure would reveal a trade secret, scientific or labour relations information of the College or a third party;
    5. The disclosure would reveal information relating to specific tests or testing procedures or techniques that are to be used for educational purpose; or
    6. The record or information is subject to solicitor-client privilege.

Disclosure of Information to a Third-Party

  1. The College may use and disclose personal information and confidential information for the purposes for which it was collected or generated or for any consistent purpose. The College shall identify the primary purposes at the time of the collection or generation of the information.
  2. The College may provide personal information to an organization that is providing a service to students or employees on behalf of the College – e.g. health insurance or other benefits – or is conducting a mandated or required activity – e.g. Graduate Satisfaction Survey.
  3. In addition, the College may disclose personal information or confidential information with the specific, written consent of the individual or third party, or as otherwise permitted or required under FIPPA, PHIPA or any other applicable law.  Specific guidance on the disclosure of personal information is provided below.
  4. Confidential personal information and records will be released posthumously only with the authorization of the President.
  5. The health, safety or security of an individual or the College may take precedence over the confidentiality of information and records, and the privacy of an individual. In those instances in which there is a serious threat of danger to a person or persons or the institution, the College may disclose confidential information about a student or employee to an appropriate health or security agency or immediate family member. See the Disclosure of Information in the Event of Emergency (4000-3-5) policy.
  6. In the case of video surveillance data, access, based on an identified need, may be granted to appropriate College personnel by the Director, Facilities Management. Release of video surveillance data to outside agencies, including police, must be authorized by the Director, Facilities Management, and shall be consistent with the terms of this policy.

Parents

  1. For any student who is at least 16 years of age, personal information or records will be released to a parent only with specific, written consent of the student.

Sponsoring or Funding Agencies

  1. The College will provide personal information or records concerning a student on the request of the agency only with the written authorization of the student, or as otherwise required by law.

Police and Courts

  1. In the event that a student record or personal information is subpoenaed by a court (or any other decision-maker with the authority to compel information) on behalf of the student, a certified copy of the requested student record or information will be offered.  Should the record or information be subpoenaed by a party other than the student, or a party representing the student, a certified copy of the record or information will be provided to the judge (or other decision-maker) alone, with an explanation of the College's reluctance to release a private record or information without student authorization.
  2. Personal information or other confidential information may be released to the police or other law enforcement agency only where such disclosure is to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result. If the police request information under a warrant or other court order, disclosure shall be limited to the terms of the warrant.

Government Agents

  1. Confidential personal information and records will be released to government agents or agencies as required by law, and then only that information specifically requested will be released.  Where the requested disclosure is not required by law, specific, written consent of the individual must be obtained.

Researchers

  1. Requests from external researchers undertaking statistical studies for personal information and records must be approved by the President, or designate, under conditions that protect the individual's privacy, guarantee the anonymity of the data collected and are consistent with the ruling of the Research Ethics Board. Only that information specifically requested will be released. Any disclosure of personal information for research purposes shall comply with all applicable statutes and regulations.

Fundraising

  1. The College may disclose alumni information to the Lambton College Foundation and the subsidiary Lambton College Alumni Association for the purposes of fundraising activities. The College shall ensure that the disclosure of alumni information for fundraising purposes is limited to that information reasonably necessary for the fundraising purposes. The College shall also ensure, by written agreement that the Foundation complies with the requirements of section 42 of FIPPA, as they relate to fundraising activities.

Breach of Confidentiality or Privacy

  1. Breach of confidentiality or privacy includes any unauthorized or inappropriate access to, or disclosure of, personal information or other confidential information or records, whether such access or disclosure is intentional or inadvertent.
  2. Any employee who becomes aware of a breach of confidentiality or privacy must immediately inform the administrator (director, dean, Registrar) responsible for the records.
  3. The responsible administrator shall immediately inform their Vice-President of the breach and, subsequently, steps taken to address the breach and to prevent further breaches. These actions shall be taken under the direction of the Vice-President and senior leadership of the College.
  4. As directed by senior leadership, the responsible administrator shall inform the individual(s) affected by the breach of the incident, including information of any measures being undertaken to address the breach.
  5. The responsible administrator shall develop and implement process or protocols to prevent any further breaches, and shall consult with other responsible administrators in determining the appropriate processes and protocols to put in place.

Definitions

Student
includes persons currently registered as full-time or part-time students and, where relevant, may be construed to include past registrants including graduates, and applicants who have not, or do not, attain registered student status.
Record
means any records of information however recorded (in print, on film, electronically, etc.) and includes, but is not limited to, the following: a student file, an employee file, correspondence, e-mail, memorandum, a drawing, photograph, a sound recording, and a video recording.
Personal Information
is information about an identifiable individual. It includes, but is not limited to, the following: gender, age, sexual orientation, marital or family status, race, national or ethnic origin, information related to employment, information related to educational history (except for Public Information as defined in this policy), information related to medical, psychiatric, or psychological history, prognosis, condition, treatment or evaluation, social insurance number (SIN), student number, home address, telephone number, personal opinions of or about an individual, correspondence from, to or about an individual that is implicitly or explicitly of a private nature.
Confidential information
refers to information that is not generally known to the public and which, by its nature and content, ought to be kept private, and includes personal information of identifiable individuals as well as confidential information provided to the College by third parties.
Confidentiality
refers to the keeping private and the non-disclosure of confidential information of any kind, and requires that confidential information not be disclosed, shared or disseminated in any manner other than in the conduct of College business or as permitted in this policy.
Privacy
refers to the access to the records of individuals and requires that those records and the information contained therein be viewed or accessed only by an employee, consultant or agent of the College for whom there is a valid need, on the occasion of the accessing, in order to conduct the College business required of them.

Appendix A

Lambton College Statement on Collection of Personal Information and Protection of Privacy

Lambton College collects, uses, discloses and retains personal information about students, alumni, employees and persons who use services and platforms provided by Lambton College. This information is used for the academic, administrative, employment-related, financial and statistical purposes of the College.

The information will be used and disclose, among other things, to:

  • admit, register and graduate students;
  • record academic achievement;
  • provide access to information systems;
  • operate various College programs and services;
  • administer the College; and,
  • provide services, sometimes through third parties, such as health and dental insurance.

Lambton College may collect personal information from other relevant sources such as the Ontario College Application Centre, secondary schools, colleges, universities and other institutions previously attended by the student, and third-party services and test score providers where the information collected forms a part of an application, admission or evaluation process.

Information on admissions, registration and academic achievement may be disclosed and used for statistical and research purposes by the College, other post-secondary educational institutions and the federal and provincial governments.

Lambton College does not knowingly collect personal information from children under 13 years of age without the consent of a legal guardian, and, upon learning that such information has been unintentionally collected, will delete that information unless the parent or guardian provides the required consent.

The names of alumni, their program, award information, credential(s) awarded, and date of graduation are considered public information and may be published by Lambton College. Student photographs posted by the College in the form of individual pictures or class pictures may be publicly displayed.

Aside from the foregoing, the information you provide, and any other information placed in a student or personnel record will be protected and used in compliance with Ontario’s Freedom of Information and Protection of Privacy Act and will be disclosed only in accordance with this Act. If you have any questions about the collection and use of this information please contact the College Registrar.

Lambton College uses third party service providers to assist with its marketing efforts and provision of Lambton College services. When information is shared with third party service providers, Lambton College requires that provider to maintain the privacy, confidentiality, and security of personal data and comply with applicable legislation (e.g. FIPPA) to protect the information they collect and use on behalf of Lambton College.

Lambton College provides specific, limited personal information to the Lambton College Student Government. The Student Government uses personal information for the purpose of membership, administration, elections, annual general meetings, health plans and other related matters only. Please contact the relevant Student Government office if you have questions about this use and disclosure of your personal information and their privacy policies.

Lambton College provides specific, limited personal information to the Lambton College Foundation and the subsidiary Lambton College Alumni Association. The Foundation and Association use personal information for the purpose of membership, administration, and fundraising related matters only. Please contact the Foundation if you have questions about its use of your personal information and its privacy policies.

Appendix B

As part of Lambton College's commitment to Equity, Diversity, and Inclusion (EDI), we collect certain data from students at the point of application to the College. This data helps us to better understand the diverse backgrounds of our students and to ensure equitable policies, programs, and services.

The data we collect includes demographic information such as ethnicity, religion and/or spiritual self-identity, sexual orientation, disability, and military-connected status. We understand that this information is personal and sensitive, and we take the responsibility of collecting and using it very seriously. All information collected is kept confidential and will be used solely for the purposes of improving our programs and services and furthering our commitment to EDI within our institution.

Personal information provided will be collected, protected, used, disclosed, and retained in compliance with Ontario's Freedom of Information & Protection of Privacy Act and Lambton College's Confidentiality & Privacy of Information & Records (2000-7-1) policy and Data Assurance (4000-5-15) policy.

If you have any concerns or questions about the collection and use of this data, please do not hesitate to contact Patrick Bennett, Director, Institutional Intelligence & College Registrar at patrick.bennett@lambtoncollege.ca.


For questions or concerns regarding this policy, please contact the Policy Sponsor by phoning our main line 519-542-7751.