Collecting Personal Information at UBC: A Guide for Faculty and Staff

FIPPA and Personal Information Collection at UBC

While UBC doesn't require consent for collecting personal information crucial for its services, FIPPA dictates strict regulations for this process. FIPPA serves as the provincial privacy law, mandating responsible collection practices. This means information collected must be directly relevant to UBC programs, obtained directly from you, and kept to a minimum.

Key Points on FIPPA and Personal Information Collection

• Consent Not Always Required: UBC can collect personal information without your consent under FIPPA, but they must have the legal authority to do so.
• Authorized Reasons for Collection: The most common justifications for collecting personal information fall under specific sections of FIPPA (sections 26(a) to 26(g)). These include situations where the information is:
  • Directly authorized by another Act (26(a)).
  • Required for law enforcement (26(b)).
  • Directly related and necessary for a UBC program or activity (26(c)). (This is the most common scenario at UBC).
  • Needed for program planning or evaluation (26(e)).
  • Essential for preventing domestic violence (26(f)).
  • Gathered through observation at public events (26(g)).
• Demonstrating Necessity: To ensure "necessity" for collecting information, UBC must show it's crucial for program operation and there are no viable alternatives.
• Unsure About Collection Authority? Consult Legal Counsel: If you're unsure if you have the legal authority to collect personal information in a specific situation, contact the Office of the University Counsel for guidance.

Methods of Personal Information Collection

There are four primary methods for collecting personal information:

1. Informed Direct Collection: This involves informing individuals that you are collecting their information and acquiring it directly from them. An example is requesting a job applicant to complete an application form.
2. Informed Indirect Collection: You inform individuals about the collection, but obtain the information from a third-party source. For instance, contacting a job applicant's references to verify credentials.
3. Uninformed Direct Collection: This occurs when you collect information directly from someone without their knowledge. An example is accessing a student's account and reading their emails without permission. (This is not a recommended practice)
4. Uninformed Indirect Collection: Here, you gather information about someone from a third party without their knowledge. An example is interviewing an employee's colleagues to determine their suitability for an award, without their knowledge. (This is also not recommended)

FIPPA and Privacy Notifications

FIPPA emphasizes informing individuals that their personal information is being collected. You must disclose your legal authority for requesting the information, its intended use, and who to contact with questions about the collection process. This is called a "privacy notification".

Best Practices for Collecting Personal Information

• Direct Collection: It's preferable to collect personal information directly from the individual involved. If indirect collection is necessary (like conducting reference checks), the privacy notification should clearly explain the method.
• Uninformed Collection: Uninformed collection of personal information is only permitted in exceptional circumstances. Consult Legal Counsel in the Office of the University Counsel before engaging in uninformed collection.

Go Further...

• Learn more about the collection of personal information by UBC