Frequently Asked Questions
May I take attendance in class?
Yes, if you wish to take attendance you may do so, but collect only the information you need to confirm a student’s presence and use the most privacy-sensitive manner appropriate to the situation. (i.e., verbal roll-call, or asking for only the last five digits of the student ID number on sign-up attendance sheets. If you use a sign-up sheet, do not include any other identifiers like names, etc.)
Can the university use services of companies which would store University of Waterloo data on non-Canadian servers?
Yes. The following protocol must be followed when deciding whether to use a service which would store University of Waterloo data on a server owned by a non-Canadian company. 1) In the first instance, determine whether a suitable Canadian alternative exists; 2) Where one does not exist, or where one exists, but is arguably inferior or does not meet our needs, then use the non-Canadian company and; 3) Ensure that the contract with that company has good data protection practices included.
Information requests
How do I request information at the University of Waterloo?
Requests for information and responses to such requests should be handled as they have in the past and as openly as possible. A Freedom of Information and Protection of Privacy Act (FIPPA) request should be an instrument of last resort, used only in the event access to information requested is not provided.
What information can be released about Waterloo?
Information accessible prior to the implementation of FIPPA, in most instances, remains accessible. See: Guidelines on Responding to Requests for Information. Under FIPPA, the university must make records accessible unless the Act provides an exemption. The FOIP Coordinator assists faculties and academic support departments in determining whether records will be released.
How do I request access to my own personal information?
Existing policies and procedures should be followed.
How should I deal with requests for information from the press / media?
Every effort should be made to accommodate such requests as quickly, expeditiously and with a view to maintaining the university’s reputation. Where, in response to media questions, information cannot be released informally, refer the inquirer / question immediately to the Associate Vice-President, Communications and Public Affairs. Where members of the media make formal FIPPA requests the Vice-President, Communications and Public Affairs will be consulted.
Records under FIPPA
Are all records at the University covered by FIPPA?
No. Most employment-related records, research-related records and records of teaching material are excluded from FIPPA. Almost all other records in the custody or control of the university regardless of their subject matter or how they are stored (i.e., in print or electronically) are covered by the Act. These may include records in the offices of university employees.
How is email affected by FIPPA?
Faculty and staff's email communication on university matters may be required to be disclosed under FIPPA and therefore care and professionalism should be exercised.
See also Guidelines on use of e-mail
FIPPA requests
How do I make a FIPPA request?
Please contact the university's Privacy Officer to make a request.
Do I have to pay to make a FIPPA request?
FIPPA requests must be accompanied by a $5 fee payment. Make your cheque or money order payable to the University of Waterloo. Other charges may be assessed. A fee estimate will be provided where the charges are likely to exceed $25. Where the estimate is $100 or more, partial payment in advance will be required before the request is processed.
What is personal information?
Personal information is information about an identifiable individual and it is not disclosed, except as may be prescribed in Policy 46. It includes things such as an individual’s home address and home telephone number, student number and educational history (including grades). It does not include information that relates to an individual in their professional or employment capacity or as a spokesperson for an organization (e.g. business contact information, business correspondence and other work product of university employees and agents).
How will the University of Waterloo respond to an applicant after it has processed an applicant's request?
If the access request is granted, the university will advise the applicant how to access the requested records. If the university does not have any records which respond to the request, if it needs more time to answer a request or if it is relying on an exemption to deny the request, it will also respond in writing with an explanation.
Is the University required to create a record from data that is in electronic form?
The university must create a record for an applicant if the record can be created from data that is in electronic form (e.g., in an electronic database) and producing the record will not unreasonably interfere with the operations of the university.
If records have been sent for destruction but not yet destroyed when an access request is received, does the University of Waterloo have to include such records in the request process?
Yes. When a request for records is received all records requested are frozen and no further actions may be taken to destroy the requested records if they have been designated for destruction. This includes hard copy records that have been designated and sent for destruction but not yet destroyed and e-mails not yet deleted from your system.
When does Waterloo notify third parties about access requests?
If the university is considering giving an applicant access to a record containing personal information or confidential business information of a third party, then the FOIP Coordinator will give notice to the third party.
Who at Waterloo makes the final decision for release of information under FIPPA?
FIPPA allows the Executive Head to delegate responsibility under the Act. Authority for making the final decision to release information has been delegated to the Secretary of the University, Karen Jack.
Consequences for non-compliance
What are the consequences to Waterloo if it does not comply with the FIPPA legislation?
Apart from possible adverse publicity, the Information and Privacy Commissioner has the right to order compliance. In addition, the Act allows for fines up to $5000.00 or six months imprisonment or both. The FOIP Coordinator will assist in ensuring that the university complies with the legislation.
Faculty and staff
Can records of expense accounts be accessed under FIPPA?
University employees should be aware that expense accounts submitted to the university for the purpose of seeking reimbursement for expenses incurred in employment may be disclosed to the public pursuant to FIPPA. This does not include records of expenses which are charged exclusively to a research account.
Students
May I collect personal information about a student?
The university may collect personal information only where it is necessary for the proper administration of the university and is consistent with the university's notice of collection. Personal information may only be collected directly from the individual to whom the information relates unless certain conditions apply. The conditions are limited and specific; please consult with the university's Privacy Officer before collecting personal information indirectly.
Can faculty and staff members continue to provide references for students without consent from the student?
Faculty and staff members should not provide a reference, written or oral, without the consent (preferably written) of the student.
Photographs
Can the university provide students with identification cards that include photographs and other personal information?
Yes. The identification card is in the custody of the student. The student controls the disclosure of personal information contained on the card so there is no breach of privacy.
Can photographs be taken at public events on the campus?
Yes. When students or employees participate in a public event on the campus, there is no expectation of privacy and Waterloo may publish photographs that provide evidence of participation at a public event. If you wish to publish photographs which feature identifiable individuals, then you should seek consent. Complete the Model Release form (PDF).