Privacy Reports

INVESTIGATION REPORT

 

 

INVESTIGATION I93-083P

 

 

A COLLEGE OF APPLIED ARTS AND TECHNOLOGY

INTRODUCTION

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a College of Applied Arts and Technology (the College).

 

The complainant had been a student in the College's nursing program.  In the College's nursing division it was the practice of the professors to prepare anecdotal notes for each student.  These anecdotal notes were reviewed by the students in weekly assessments with the professors, and were used in the preparation of the students' final evaluations.  The complainant requested access to her anecdotal notes and was informed by the College that these notes had been destroyed.

 

The complainant was concerned that the College had prematurely destroyed the anecdotal notes, containing her personal information, contrary to the Freedom of Information and Protection of Privacy Act (the Act).  She was also concerned about the security of the anecdotal notes, stating that the notes were kept in a binder readily accessible to all College students.

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information", as defined in section 2(1) of the Act?  If yes,

 

            (B)       Were the anecdotal notes in the custody or under the control of the College?  If yes,

 

            (C)       Was the personal information retained by the College in accordance with section 5(1) of Regulation 460 under the Act, as amended by Regulation 532/93?

 

(D)       Were reasonable measures in place to prevent unauthorized access to the personal information in accordance with section 4(1) of Regulation 460 under the Act, as amended by Regulation 532/93?

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information", as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(g)        the views or opinions of another individual about the individual, and

 

(h)        the individual's name where it appears with other personal information relating to the individual...

 

The anecdotal notes consisted of written evaluations about the complainant made by the complainant's professor.

 

In our view, this information met the requirements in paragraphs (g) and (h) of the definition of personal information in section 2(1) of the Act.

 

            Conclusion:    The information in question was personal information as defined in section 2(1) of the Act.

 

 

Issue B:           Were the anecdotal notes in the custody or under the control of the College?

 

In this case, the complainant was informed by the College that the anecdotal notes she had requested had been destroyed.  However, she was also informed that the anecdotal notes were the professors' personal notes, prepared by the professors for their own use, and were, therefore, not in the custody or control of the College.

 

Therefore, before we address the complainant's concerns, we must determine whether the anecdotal notes were in the custody or under the control of the College, within the context of the Act.  Accordingly, we have reviewed pages 10-12 of Order 120, where former Commissioner Sidney B. Linden made the following statement:

 

In my view, it is not possible to establish a precise definition of the words "custody" or "control" as they are used in the Act, and then simply apply those definitions in each case.  Rather, it is necessary to consider all aspects of the creation, maintenance and use of particular records, and to decide whether "custody" or "control" has been established in the circumstances of a particular fact situation.

 

Commissioner Linden went on to provide the following non-exhaustive list of factors which can be of assistance in determining whether an institution has "custody" and/or "control" of records in particular situations:

 

1.         Was the record created by an officer or employee of the institution?

 

2.         What use did the creator intend to make of the record?

 

3.         Does the institution have possession of the record, either because it has been voluntarily provided by the creator or pursuant to a mandatory statutory or employment requirement?

 

4.         If the institution does not have possession of the record, is it being held by an officer or employee of the institution for the purposes of his or her duties as an officer or employee?

5.         Does the institution have a right to possession of the record?

 

6.         Does the content of the record relate to the institution's mandate and functions?

 

7.         Does the institution have the authority to regulate the record's use?

 

8.         To what extent has the record been relied upon by the institution?

 

9.         How closely is the record integrated with other records held by the institution?

 

10.       Does the institution have the authority to dispose of the record?

 

We have reviewed these factors while considering the College's position.  It is our view that the anecdotal notes were in the custody and under the control of the College.

 

Anecdotal notes are written and retained by the professors to assist them in the preparation of the final written clinical evaluations for the students. The clinical evaluations reflect the success or failure of the student in the clinical nursing course.  The College does, in fact, recognize clinical evaluations, created from the anecdotal notes, as College records, in the custody and under the control of the College.

 

During the weekly assessment of the students, the professors refer to the anecdotal notes and allow the student to read the notes.  If a student reads the anecdotal notes, he/she may be asked to sign the notes to acknowledge that the notes have been read.  When a student appeals a failing grade, the Dean of Health Sciences and Human Services may request a justification from the professor for this failing grade and the anecdotal notes may be used for this more detailed explanation of the grade assigned.

 

The College advised the complainant that, while in her case the anecdotal notes she requested had been destroyed, it was the current practice of the professors to retain the anecdotal notes for one year in case there was an appeal of a failing grade and after one year all anecdotal notes are destroyed. 

 

Based upon this information, in our view, the anecdotal notes were in the custody and under the control of the College.

 

            Conclusion:    The anecdotal notes were in the custody and under the control of the College.

 

 

Issue C:          Was the personal information retained by the College in accordance with section 5(1) of Regulation 460 under the Act, as amended by Regulation 532/93?

 

Section 5(1) of Regulation 460, as amended by Regulation 532/93, states:

Personal information that has been used by an institution shall be retained by the institution for at least one year after use unless the individual to whom the information relates consents to its earlier disposal.

 

On December 29, 1992, the complainant requested copies of the anecdotal notes for the March 9 to May 1, 1992 semester, from the College.  She was informed on January 26, 1993, by the Dean, Health Sciences and Human Services, that the anecdotal notes for that period had been destroyed.  On March 4, 1993, she made a request under the Act for access to the anecdotal notes.  The College responded to the access request by saying that all anecdotal notes prepared by the complainant's professor (except those for current students) had been destroyed.  The College maintained that this was not done purposely to prevent the complainant from receiving copies.

 

The College provided our office with a copy of a policy entitled "Retention of Records and Correspondence".  This policy states that the retention of instructors' records of student grades for tests, assignments and other activities on which end-of-the-semester grades are based must be retained by instructors for the period of time specified in the policy entitled "Course Grade System for Recording Academic Standing".  While the College informed the complainant that it was the current practice of the professor to retain the anecdotal notes for one year, the portion of the policy relevant to this matter states that the information must be retained for at least one semester following the semester to which the notes apply, for use in the event of appeals against the grade.  The policy does not state that the notes must be retained for one year.

 

Since the anecdotal notes were used to prepare the complainant's final clinical evaluation, and the notes were dated from March 9 to May 1, 1992, the anecdotal notes would have last been used by the professor in May 1992.  When the complainant initially wrote to the College requesting the anecdotal notes, she was informed on January 26, 1993, that the anecdotal notes had been destroyed.  It is our view that, since the complainant did not consent to the notes earlier disposal, the College did not retain the anecdotal notes for the prescribed minimum period of one year after use.

 

In our view, the College's retention of the anecdotal notes, containing the complainant's personal information, was not in accordance with section 5(1) of Regulation 460.

 

            Conclusion:    The College's retention of the personal information was not in accordance with section 5(1) of Regulation 460, as amended by Regulation 532/93.

 

 

Issue D:          Were reasonable measures in place to prevent unauthorized access to the personal information in accordance with section 4(1) of Regulation 460 under the Act, as amended by Regulation 532/93?

 

Section 4(1) of Regulation 460, as amended by Regulation 532/93, states that:

 

(1)        Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.

The complainant questioned the security of the anecdotal notes while they were maintained by the College.  She stated that the notes were kept in a binder readily accessible to all College students.

 

In our view, the College has a responsibility to ensure that its policies and procedures regarding the maintenance and security of the anecdotal notes adhere to the requirements set out in section 4(1) of the Regulation.

 

In this regard, the College has stated that anecdotal notes are not "readily accessible" to students, nor are they readily accessible to other employees of the College.  Professors may keep anecdotal notes together in a binder but there is an understanding that anecdotal notes contain private and confidential information which is not accessible to anyone other than the faculty member and is shared only with the individual students.  Any information that is revealed to any one student would only be his/her own.

 

The College informed us that there is no policy which dictates how nursing professors should maintain anecdotal notes.  However, it has been communicated to faculty members at divisional meetings that they are expected to take appropriate precautions to safeguard the anecdotal notes.

 

It is our view that while the College may have communicated to faculty members the importance of safeguarding the anecdotal notes, any reasonable measures to prevent unauthorized access to the personal information contained in the notes have not been defined, documented and put in place as required in section 4(1) of Regulation 460.

 

            Conclusion:    Reasonable measures were not defined, documented and put in place to prevent unauthorized access to the personal information, in accordance with section 4(1) of Regulation 460, as amended by Regulation 532/93.

 

 

SUMMARY OF CONCLUSIONS

 

●         The information in question was personal information as defined in section 2(1) of the Act.

 

●         The anecdotal notes were in the custody and under the control of the College.

 

●         The College's retention of the personal information was not in accordance with section 5(1) of Regulation 460, as amended by Regulation 532/93.

 

●         Reasonable measures were not defined, documented and put in place to prevent unauthorized access to the personal information, in accordance with section 4(1) of Regulation 460, as amended by Regulation 532/93.   

 

 

RECOMMENDATIONS

 

We recommend that:

1)         the College amend its policy on "Course Grade System for Recording Academic Standing" to include the anecdotal notes, and to ensure that the anecdotal notes are retained in accordance with section 5(1) of Regulation 460 under the Act, as amended by Regulation 532/93.

 

2)         the College ensure that measures are in place to prevent unauthorized access to the anecdotal notes and that these measures are "defined" and "documented" as required by section 4(1) of Regulation 460 under the Act, as amended by Regulation 532/93.   

 

3)         the College ensure that all professors are made aware of the above policy amendments and security measures when they have been implemented.

 

 

Within six months of receiving this report, the College should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

 

Original signed by:                        January 6, 1994        Susan Anthistle                                                                               Date

Compliance Review Officer

 

****