PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC06-85

 

 

Ryerson University

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   PC06-85

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            Ryerson University

 

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

The Information and Privacy Commissioner/Ontario (IPC) was contacted by a student at Ryerson University (the University) regarding the University and the Golden Key International Honour Society (the Society).  Specifically, the concern related to the University’s use of students’ personal information for the purpose of providing it to the Society.

 

As a result, the IPC initiated a privacy complaint investigation under the Freedom of Information and Protection of Privacy Act (the Act).

 

Background

 

During the course of the investigation, the University provided the following information with respect to its involvement with the Society.

 

The Society is an international not-for-profit organization that operates chapters at universities across the world.  The Society’s purpose, which is set out on its website, states:

 

Golden Key is an academic honour society which recognizes and encourages scholastic achievement and excellence among college and university students from all academic disciplines.  The Society awards its members over $400,000 annually through 17 different scholarship and award programs.

 

All students that have completed at least one year of university studies and rank in the top 15 per cent of their class are eligible to join the Society.  The University assists in facilitating this process on behalf of the Society by identifying students that are eligible for membership and sending an invitation, provided by the Society, to each student who qualifies.

 

According to the University, membership in the Society can be beneficial to students as:

 

• The Society awards its members over $400,000 annually through scholarships;
• The Society’s members are provided with networking opportunities; and
• The Society promotes campus and community service opportunities.

 

The University administers the mailing of invitations by first compiling a list of all students who qualify academically for membership in the Society (i.e., students who rank in the top 15 per cent of their class).  Based on this list of eligible students, the University generates mailing labels which are affixed to the invitations that have been provided by the Society.  Once prepared, these mailings are sent to students, and students have the choice to either accept or decline the invitation to join the Society.  A one-time $90 membership fee is charged to people that are interested in joining the Society.

 

Because invitations are processed and mailed by the University, the Society does not receive a list of the names of eligible students prior to students receiving invitations.  Rather, the Society only receives the names of students that have decided to accept the Society’s invitation.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

The information at issue is the names of students and their contact information, which is affixed to the Society’s invitations.  This information also identifies the students as those that rank in the top 15 per cent of their class, by virtue of the fact that only students with this ranking qualify.

 

The definition of “personal information” is contained in section 2(1) of the Act, which states in part:

 

“personal information” means recorded information about an identifiable individual, including,

…

(b)                information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

…

 

(d)               the address, telephone number, fingerprints or blood type of the individual,

 

…

(h)               the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual … [emphasis added].

 

Based upon this definition, I am satisfied that the information described above clearly qualifies as “personal information”.  The University concurs with this finding.

 

Was the use of the “personal information” in accordance with section 41 of the Act?

 

As expressed above, the University stated that it uses the personal information of its student body to identify those students that qualify for membership in the Society.  The list is then used to generate labels that are affixed to the invitations provided by the Society and mailed to the students.  The act of compiling a list of eligible students and facilitating mailings on behalf of the Society would be considered to be a “use” of personal information under the Act.

 

Section 41(1) of the Act contains a general prohibition on the use of personal information, but states that personal information may be used in a number of enumerated circumstances.  In order for an institution to demonstrate that a given use of personal information is permissible, it must show that it is in accordance with at least one of the exceptions set out in section 41(1).

 

Section 41(1) of the Act states:

 

An institution shall not use personal information in its custody or under its control except,

 

(a)                  where the person to whom the information relates has identified that information in particular and consented to its use;

 

(b)                  for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(c)                  for a purpose for which the information may be disclosed to the institution under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act; or

 

(d)                 subject to subsection (2), an educational institution may use personal information in its alumni records for the purpose of its own fundraising activities, if the personal information is reasonably necessary for the fundraising activities.

 

In this case, the University has taken the position that its use of personal information is in accordance with section 41(1)(b), which permits the use of personal information for the same purpose for which it was obtained or compiled, or for a consistent purpose.

 

In considering whether a given use of personal information is in accordance with section 41(1)(b), it is first necessary to determine the purpose of the collection of personal information in question.  Next, it is necessary to assess whether the use of this information can be properly characterized as being for either the original purpose of the collection, or for a purpose that is consistent with that original purpose.

 

I have reviewed the Notice of Collection that the University is using in connection with the personal information that it is collecting from its student body.

 

Under section 39(2) of the Act, institutions that collect personal information are required to provide individuals with a Notice of Collection that sets out:

 

• The legal authority for the collection;
• The principle purpose or purposes of the collection; and
• Contact information of an individual who may answer questions about the collection.

 

With respect to the student information that it collects, the University is currently satisfying this requirement through a Notice posted on its website.  This Notice states:

 

Information submitted by students is collected under the authority of the Ryerson University Act and will be used for the purpose of creating or maintaining your academic record.  The information will be used to support decisions relating to course and/or certificate enrolment, transfer credit (including Letters of Permission and Challenge Credits), tuition fees assessment, and eligibility for government or University aid programs.  You should be aware that aggregated student academic data (grades and academic standings, for example) are occasionally used for statistical, audit and research purposes, and for development purposes intended to improve university education.  No personally identifiable data, except that which is provided for by law, is ever released without the express written consent of the student.  If you have questions about the collection, use and disclosure of this information by the University, please contact the Office of the Registrar, 350 Victoria Street, Toronto, Ontario, M5B 2K3, 416-979-5000, ext. 6056.

 

In addition, it is also helpful to look to the Ryerson University Act, which provides the University with the authority, among other things, to determine curricula and grant degrees.  Section 3(1) of the Ryerson University Act states:

 

The objects of the University are:

 

(1)               The advancement of learning, and the intellectual, social, moral, cultural, spiritual, and physical development of the University's students and employees, and the betterment of society. … .

 

(2)               The advancement of applied knowledge and research in response to existing and emerging societal needs and in support of the cultural, economic, social, and technological development of Ontario.

 

(3)               The provision of programs of study that provide a balance between theory and application and that prepare students for careers in professional and quasi-professional fields.

 

In its response to our office, the University stated that it collects personal information from its students for a number of educational purposes.  In support of this position, the University stated:

 

Ryerson University obtains personal information from students for a number of purposes, including but not limited to:

 

•         eligibility and assistance with student financial aid

•         support for decisions relating to courses and/or certificate enrolment

•         transfer credit

•         tuition fees assessments.

…

 

The University goes on to state:

 

In a university environment, the use of personal information in facilitating the Golden Key mailings is consistent with educational purposes ….  As discussed above, educational purposes extend beyond the classroom to the recognition of academic achievement [emphasis added].

 

The term “consistent purpose” is defined in section 43 of the Act as follows:

 

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(1)(b) and 42(1)(c) only if the individual might reasonably have expected such a use or disclosure.

 

With respect to its involvement in the Society’s mailings, the University has taken the position that its role in compiling the list of qualifying students and assisting in the mailings is an activity that would be reasonably expected by students and would therefore qualify as a “consistent purpose” under the Act.

 

 

 

 

The University has also stated:

 

Ryerson University views education holistically and includes all aspects of university life.  Our goal is to make our students’ experience highly positive from the application process through assistance with job placement.  We view it as our responsibility and our mandate under the umbrella of educational purpose to administer and facilitate a broad spectrum of student services in order to accomplish this goal. …

 

Ryerson University therefore considers providing students with beneficial opportunities including the opportunity to receive government, university, private sector and other forms of scholarships and/or financial aid and other awards and recognition to be within the parameters of educational purposes.

 

The University noted that it has not received any complaints from students regarding its involvement with the Society in the time since the Ryerson Chapter of the Society was established in 1999.  In considering whether the University’s involvement with the Society is permitted under the Act, I am mindful of the fact that Society is a not-for-profit organization that exists in order to provide benefits for its members.  Had the University been involved in facilitating mailings in order to assist with the marketing activities of a private sector company, my conclusion that follows may not have been the same.

 

Based on my review of the information provided by the University, and the University’s Notice of Collection, I am satisfied that its use of student information in facilitating the Society’s mailings is for a consistent purpose and is therefore is in accordance with section 41(1)(b) of the Act.

 

In addition, although I am satisfied that the University’s Notice of Collection meets the requirements set out in section 39(2) of the Act, in response to this investigation, the University indicated that they reviewed the Notice and have identified areas in which the Notice could be improved to provide further clarity to students.  The proposed amendments to the Notice include:

 

• A statement that student information will be used to determine eligibility for access to financial aid programs, scholarships, bursaries and awards, including, but not limited to, monetary and non-monetary student recognition awards and other forms of student support; and

 

• A statement that personal information may be disclosed for the purpose for which it was obtained or compiled or for a consistent purpose.

 

Although adoption of these amendments would not be required in order to bring the University’s Notice of Collection into compliance with the Act, I agree that these changes would add more clarity and transparency to the University’s processes.

 

Finally, I note that the University has taken steps to ensure that student information is not disclosed to the Society prior to students’ acceptance of the invitations.  As a result, the University has demonstrated an awareness of student privacy and has enhanced the security and privacy of student information.  The fact that the University has not received any formal complaints from students lends further support to the notion that the University’s involvement with the Society is in accordance with student expectations.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

• The information in question qualifies as “personal information” as defined in section 2(1) of the Act.

 

• The personal information is used in accordance with section 41 of the Act.

 

 

 

 

 

 

 

 

 

Original Signed By:                                                                            April 17, 2007

Mark Ratner Investigator