Privacy Policy
| AC-ACADAFF-POL-035 Privacy Policy | |
|---|---|
| Department | Academic Affairs |
| Creation Date | January 31, 2023 |
| Approval Date | February 14, 2023 |
| Effective Date | February 15, 2023 |
Organizational Scope
Purpose
To set out Michener’s obligations to manage and protect records in their custody or control under the Freedom of Information and Privacy Protection Act (FIPPA), 1990 referred to in this policy as “FIPPA” or the “Act”.
Scope
FIPPA establishes the rules for providing access to records held by Michener and protecting individual privacy. FIPPA applies to all public organizations, including publicly funded post-secondary institutions and as such, Michener must maintain FIPPA compliance.
All Michener agents (faculty, staff employees, and contractors) are required to abide by this policy while handling records of personal information.
FIPPA applies to most records in the custody or control of the institution, with some exclusions and exemptions.
This policy does not apply to records of personal health information collected by Michener e.g., Chiropody Clinical. Michener records of personal health information are governed in accordance with UHN’s Privacy Policy and the Personal Health Information Protection Act (PHIPA), 2004.
Principles
Access Rights
Students have the right to request access to their own records of personal information held by Michener in accordance with FIPPA.
Any individual may request access to institutional records held by Michener in accordance with FIPPA
Students may request a correction where they believe there is an error or omission to their records of personal information.
Michener is required to respond to these requests within 30 days and in accordance with the terms of the Act.
Requests for general records or record of personal information are managed by the University Health Network (UHN) Freedom of Information (OI) Office on behalf of Michener. Michener agents must send all record requests received under the Act to the UHN FOI Office immediately for processing. An individual may submit the FOI request directly to the UHN FOI Office using the FIPPA Request Form. The UHN FOI Office notifies Michener of the request, verifies requester identity, locates records with the assistance of Michener program area staff, evaluates records under the provisions of the Act, charges and collects fees where appropriate, applies relevant exemptions or exclusions where applicable, and discloses records.
After consultation with Michener, the UHN FOI Office reports statistical information annually to the Information and privacy Commissioner of Ontario (IPC) under the provisions of the Act on behalf of Michener.
Privacy
As custodians of personal information, Michener is responsible for ensuring that personal information in its custody is treated with respect and confidentiality. Michener will ensure that all records of personal information are collected, stored, and maintained in a secure manner and are protected from unauthorized use and disclosure. Michener will uphold this requirement by applying the following privacy principles:
- Collecting, using, and disclosing only the information necessary to fulfill the authorized purpose.
- Preventing unauthorized access or disclosure of personal information by using Michener provided solutions and prescribed safeguards in accordance with Michener’s Information Management (IM) Policies.
- Following all applicable Michener policies, protocols, and procedures relating to records of personal information.
Records of personal health information held by Michener are collected, used, and disclosed in accordance with UHN’s Privacy Policy.
Records of employee personal information are collected, used, and disclosed in accordance with UHN’s Protection of Personal Information Policy (this document is housed on the UHN Intranet accessible through MyMichener).
Michener collects personal information under it authority, set out in the Notice of Collection
Michener will collect personal information with legal authority where:
- Collection is expressly authorized by a statute e.g., Ministry of Health and Long Term Care Act
- Collection is expressly authorized by the individual to who the information relate e.g., from the Ontario College Application Service (OCAS)
- Collection is necessary to fulfill an authorized institutional function
- Required by law
The UHN Privacy Office must be consulted where the collection of personal information extends beyond the purposes listed in the Notice of Collection or where personal information is being collected from someone other than the individual. Consent may be required in this case. The UHN Privacy Office can be reached at privacy@michener.ca.
Use and Disclosure
Michener may only use the personal information in it custody or control for the purpose for which it was collected and as necessary to fulfill the authorized purpose.
Michener will not disclose personal; information for a purpose inconsistent with the purpose for which it was collected except with the individual’s documented consent or where required by law. Michener will provide personal information as necessary to placement sites (e.g., to confirm that an individual student has met the placement criteria) and where Michener has a legal agreements in place to ensure that Michener’s Privacy and Security standards are met.
Safeguards
Michener will take all reasonable steps to ensure that the personal information in its custody and control is secure in accordance with Michener’s related policies. This extend to Michener’s agents, contactors, and vendors via contractual agreements.
Michener retains personal information in accordance with Michener’s Retention Guidelines. Protocols for the retention, destruction, and disposal of personal information are maintained to prevent unauthorized parties from gaining access to the information.
Privacy Complaints and Breaches
The UHN Privacy Office must be notified when personal information is suspected ort confirmed to be accessed, used, or disclosed inappropriately. The UHN Privacy Office will manage all privacy incidents with input and assistance from the applicable Michener leadership.
Individuals who believe Michener has contravened the Act’s privacy provisions have the right to complain to the Information and Privacy Commissioner of Ontario (IPC). The IPC also receives appeals of decisions made under the access to Information provisions of the Act.
Associated Documents
Michener Retention Guidelines
Michener Privacy Incident Protocol and Checklist
Definitions
Personal Information: Means recorded information about an identifiable individual, including,
(a) information relating to the race, national or ethnic origin, religion, age, sex, sexual orientation, or marital or family status of the individual,
(b) information relating to the education or medical, psychiatric, psychological, criminal, or employment history of the individual, or information relating to financial transactions in which the individual has been involved,
(c) any identifying number, symbol, or other particular assigned to the individual,
(d) the address, telephone number, fingerprints, or blood type of the individual,
(e) the personal opinions or views of the individual, except where they relate to another individual,
(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,
(g) the views or opinions of another individual about the individual, and
(h) the individual’s name where it appears with other personal information relating to the individual or where disclosure of the name would reveal other personal information about the individual.
Record: (as defined by FIPPA and MFIPPA) Means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise
(a) correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial, or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material regardless of physical form or characteristics, and any copy thereof, and
(b) subject to the regulations in FIPPA, any record that is capable of being produced from a machine readable record under the control of the Institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the Institution.
Request: Means a Freedom of Information (GOI) access request, including both request for general records and request for one’s own personal information.
Appendix B
The Michener Institute Notice of Collection
The Michener Institute respects your privacy, Personal information that you provide to Michener is collected pursuant to the Ministry of Health and Long Term Care Act, 1990, section 6.1.3. Personal information is collected for the purpose of administration, admissions, registration, academic Programs, institution-related student services, activities of student councils, safety, financial assistance and awards, graduations and university advancement, and reporting to government agencies.
At all time personal information will be protected in accordance with the Freedom of Information and Protection of Personal Privacy Act., 1990. If you have any questions, please contact the University Heath Network Privacy Office at (416) 340-4800 ext. 6937 or at FOI@uhn.ca.
