Collecting Personal Information
The purpose of this webpage is to explain how to collect personal information in accordance with the BC Freedom of Information and Protection of Privacy Act (FIPPA).
This information is provided to assist TRU faculty and staff members to understand their obligations under the FIPPA. This is not legal advice. If you have questions about the FIPPA, please contact the Privacy and Access Office at firstname.lastname@example.org.
A. When Personal Information May be Collected
Under the FIPPA, you do not need an individual’s consent to collect their personal information, but you do need to have authority under the FIPPA to do so.
At TRU, the most commonly used authorities under the FIPPA to collect personal information include:
FIPPA Section Authority to Collection Personal Information Section 26(a) The collection of the information is expressly authorized under an Act. Section 26(c)* The information relates directly to and is necessary for a program or activity of TRU. Section 26(e) The information is necessary for the purposes of planning or evaluating a program or activity of TRU. Section 26(g) The information is collected by observation at a presentation, ceremony, performance, sports meet or similar event at which the individual voluntarily appears, and that is open to the public.
*TRU almost always collects personal information under this authority, but it should be noted that more than one authority may apply.
- When collecting personal information under section 26(c), TRU needs to be able to demonstrate that the collection is “necessary”, and is essential for the effective operation of the program or activity, and there are no reasonable alternatives to the collection. If you are not sure whether you are authorized to collect personal information in a given situation, please contact the Privacy and Access Office for assistance.
B. When Collecting Personal Information
When collecting personal information from an individual the individual must be told:
- The purpose for collecting it;
- The legal authority for collecting it; and,
- The title, business address, and phone number of an employee of TRU who can answer questions about the collection of their personal information.
This is called a Privacy Notification.
C. Privacy Notification
The Privacy Notification should be in writing and should be prominently displayed on the form or webpage you are using to collect personal information. It is not necessary for individuals to sign or initial the privacy notification.
Following is the TRU standard form template to be used for TRU Privacy Notifications:
Privacy Notification – ______(i)__________
Thompson Rivers University (TRU) collects, uses, discloses and retains personal information in compliance with the BC Freedom of Information and Protection of Privacy Act (FIPPA).
Your personal information is being collected and will be used for the purposes of ______(ii)_________, or for purposes consistent with these uses. The collection of this information is permitted under section _______(iii)________ of the FIPPA. This information will be retained in accordance with TRU’s Records Retention/Destruction Policy.
Questions about the collection of this information may be directed to _____(iv)___________ at ____(v)______, _____(vi)email@example.com. or by post to: ______(vii)___________, 805 TRU Way, Kamloops, BC, V2C 0C8. Alternatively you may contact the Privacy Office at firstname.lastname@example.org.
- Name of the initiative.
- In this space describe in detail the purposes for collecting the personal information. If the personal information will be made public it should be stated here.
- Enter the section of the FIPPA that provides the general legal authority for collecting personal information.
- Departmental contact name and their title.
- Departmental contact's phone number.
- Departmental contact's email address.
- Department's name and name of the contact.
When collecting personal information it is preferable to collect it directly from the individual the information is about. If you are collecting information indirectly (e.g. conducting reference checks of a job applicant) then your privacy notification should clearly explain how you will be collecting the information.
D. Privacy Notification and Consent
There are situations when TRU must also obtain the consent of individuals for the use or disclosure of their personal information as described in the FIPPA. For example, if the personal information will be used for a "new" purpose from when it was originally collected, if the personal information will be stored outside Canada or accessed from outside of Canada, if the personal information will be disclosed to a third party.
Under FIPPA sections 32(b) and 33.1(b), a public body is required to obtain the necessary consents from individuals if the individual has indentified the information and consented "in the prescribed manner" to its new use or its disclosure inside or outside Canada by TRU.
If consent is required, a consent mechanism should be included with the Privacy Notification.
The consent must include: (a) a complete listing of the personal information involved, (b) for what purposes it will be used or disclosed, (c) to whom it will be disclosed to by TRU (if applicable), (d) the jurisdiction to which the personal information may be disclosed (if possible), and (e) the date the consent is signed and if possible, when the consent expires.
The consent requires an affirmative action by the individual and must be freely given (with no penalty).
- TRU must manage all consents in compliance with TRU's Records Retention Schedule.
Please contact the Privacy Office with any questions you may have about when consent is required.