The following forms and procedures are provided by Carleton’s Privacy Office for use by Administrative and Academic Units to help ensure Carleton’s compliance with privacy legislation.

Collection, Use and Disclosure of Personal Information

The collection, storage, utilisation, and dissemination of Personal Information concerning members of the Carleton community is only undertaken as part of ongoing efforts by the University to ensure decision making practices are based on accurate information. The university also ensures that the information gathered for one purpose is not being used inappropriately for another, and that the privacy of an individual is not compromised by disclosure of personal information to third parties without the proper approvals.

Notice of Collection (Student Registration)

Freedom of Information and Protection of Privacy legislation stipulates that no person shall collect Personal Information on behalf of an institution unless that collection is authorized by statute or necessary in the proper administration of a lawful activity. Carleton University collects Personal Information from students for use in the administrative activities of the university under the authority of the Carleton University Act and the use of collection notices on all Carleton forms make this clear. The Notice of Collection (Student Registration) contains more information about how this information will be used.

Notice of Collection (General)

Frequently academic and administrative units collect Personal Information from individuals for a variety of purposes. This Notice of Collection (General) can be added to any form used to collect Personal Information and can be customized with the name and contact information of a direct contact within the faculty or department, usually the Departmental FIPPA Representative. If you require assistance determining the purpose of collection, please contact the Privacy Office.

Disclosing Personal Information to Third Parties

In most cases FIPPA does not allow the disclosure of Personal Information without the consent of the individual involved. Occasionally, however, individuals wish the disclosure of their Personal Information to a Third Party. This may include for an employment or academic reference or to release information regarding tuition fee balances. The Third Party Authorization form should be used to grant permission in such cases.

Consent to Use or Publish

The use of student, faculty or a staff member’s work, testimonials, images and other materials for promotional or other purposes requires the consent of the student, faculty or staff member. In some cases where the student, faculty or staff member submits items for publication or use, consent is implied. Generally, however, it is best to obtain explicit consent by asking the student, faculty or staff member to sign a consent form. The Consent to Publish Information form can be used in most cases. For more information or for help in drafting consent forms for specific purposes, please contact Carleton’s Privacy Office.

Guidelines for Photographs, Video and Audio Recordings

We are continuously developing tools and resources to assist the campus community with the collection and use of photographs, audio and video recordings. These guidelines are being drafted based on consultations with different units on campus. An announcement will be made as soon as they’re available.

In an effort to address notification requirements for various events held in our community, we recommend using a Poster Notice. This template is easy to use and is adaptable for a variety of purposes. If you need assistance with the development of the poster, or would like to amend the core text, please contact the Privacy Office.

Protection of Privacy

Faculty and staff are encouraged to treat the Personal Information of every member of the Carleton community with sensitivity and due diligence for the protection of privacy.

E-mail

Electronic communication that contains Personal Information such as grades and other evaluative material (i.e. references) should only be undertaken via official Carleton email systems. This includes Network and Connect Accounts, the alumni.carleton.ca domain, Carleton Complete and electronic teaching systems such as WebCT.

E-mail Notification for Non-Carleton Correspondence Students, staff and faculty are required to use Carleton email systems when communicating with the university. This response may be used to explain this policy when replying to email communication sent from non-enterprise systems. Directions as to where one can activate a Carleton account for students, staff, or faculty are included in this notice.

General E-mail Notification for Carleton Correspondence This notice should be attached to any email sent to or from a Carleton enterprise email system.

Taking Minutes

Minutes are considered to be a “record” under FIPPA and should contain certain pieces of information in order to make them as clear as possible, and compliant under the standards of the Act. “Minute Taking Tips” outlines the necessary pieces of information required for minutes to provide a clear record of a meeting. The procedures also provide guidance as to what information should be excluded from formal minutes in order to protect the privacy of those in attendance at the meetings. Minutes (unless containing excerpted material) are accessible with a freedom of information request and should strive to provide as much clarity as possible while respecting the privacy rights of the participants.

Privacy Breaches

A ‘privacy breach’ is an incident involving the unauthorized disclosure of Personal Information in the custody or control of Carleton. This would include Personal Information being lost, stolen, or accessed by unauthorized persons. The “Privacy Breach Incident Plan” outlines the best practices for responding to a privacy breach in four simple steps. The “Privacy Breach Reporting Form” must be filled out whenever a privacy breach has been identified. The details you provide on this form will enable Carleton’s Privacy Officer to produce a formal report, should one be required, for Ontario’s Office of the Information and Privacy Commissioner. Once the form is completed, it must be sent back to the Privacy Office (details are provided on the form).

Sharing Personal Information with Non-Carleton Service Providers

When undertaking outside (third-party) services that require the use of Personal Information in Carleton’s custody, proper use and care of this information must be assured. Standards for retention, collection, use, storage, disposal, etc. should be outlined in the contract and bind the contractor to the terms laid out which are in line with provisions under FIPPA. Please contact the Privacy Office for assistance with drafting 3rd party privacy agreements.