GUIDANCE ON RELEASE OF PERSONAL INFORMATION IN EMERGENCY OR SPECIAL SITUATIONS
April 11, 2006
As a public body subject to the Alberta Freedom of Information and Protection of Privacy Act and Regulations (the Act), the University of Alberta, in exercising its duty to protect personal information under its custody and control, may release minimal personal information concerning identifiable individuals consistent with the Act and without the informed written consent of the individuals themselves in certain situations as follows.
A. COLLECTION OF PERSONAL INFORMATION - HEALTH/SAFETY EMERGENCY
Section 34(1) of the Act: "A public body must collect personal information directly from the individual the information is about unless"
"(c) the information is collected in a health or safety emergency where"
"(i) the individual is not able to provide the information directly, or"
"(ii) direct collection could reasonably be expected to endanger the mental or physical health or safety of the individual or another person."
(d) the information concerns an individual who is designated as a person to be contacted in an emergency or other specified circumstances."
34(1)(c) exists expressly to allow emergency services personnel, as well as other necessary personnel of a public body, to collect personal information needed to deal with an emergency situation. Under this provision, a public body can collect indirectly only the information required to deal with the emergency.
B. INFORMATION RELEASE BECAUSE OF PUBLIC INTEREST
The Act states that the university must disclose to the public, to an affected group of people, to any person or to an applicant
(a) information about a risk of significant harm to the environment or to the health or safety of the public, of the affected group of people, of the person or of the applicant, or
(b) information the disclosure of which is, for any other reason, clearly in the public interest.
The Provost and Vice-President (Academic), as the FOIPP Head of the university, is the only position within the university that is authorized to disclose personal information pursuant to this section of the FOIPP Act (in accordance with the FOIPP Delegation Matrix).
If this section is invoked, the third party whose information is disclosed, and the Office of the Information and Privacy Commissioner, must be notified.
C. EMERGENCY CONTACT INFORMATION RELEASE
The university may disclose the emergency contact information provided to the university, only so that the designated spouse, adult interdependent partner, relative or friend of an injured, ill or deceased individual may be contacted. Information disclosed will be limited to only that which will facilitate the contact.
The release of emergency contact information must be made by managerial or supervisory staff who may choose to contact the emergency contact themselves, relaying the information given to them about the emergency situation. When such a disclosure occurs, the details of the situation should be documented and placed on the individual’s file
Our primary aim in the event of a valid emergency situation is to facilitate prompt notification of the designated Emergency Contact.
D. INFORMATION RELEASE TO AVERT OR MINIMIZE IMMINENT DANGER TO HEALTH / SAFETY
The university may disclose personal information where authorized staff of the public body believes on reasonable grounds that the disclosure will avert or minimize an imminent danger to the health or safety of any person. Disclosure is limited to only the amount necessary to avert the imminent danger. The Provost and Vice-President (Academic), as the FOIPP Head of the University, is the only position within the University that is authorized to disclose personal information pursuant to this section of the FOIPP Act (in accordance with the FOIPP Delegation Matrix).
If time permits, the Information and Privacy Office should be consulted prior to the release of the personal information. Our primary aim is to avert or minimize the imminent danger to the health or safety of an individual.
E. PERSONAL INFORMATION RELEASE IN RESPONSE TO POLICE INVESTIGATIONS
When police are conducting an incident investigation limited disclosure of personal information is permitted and appropriate under Section 40(1)(q) of the Act.
The Law Enforcement Disclosure form is intended to capture the required information of the requesting agency prior to the release of any information and should always be used for this purpose.
Releases must be made by the University Office of Record, even if another office might be the first one approached. That office should work with the Information and Privacy Office on the release of information to make sure the extent of disclosure is appropriate. Original request forms and documents will be held in the office of record and will be managed according to approved records retention schedules.
F. RELEASE OF PERSONAL INFORMATION FROM CAMPUS SECURITY FILES
If a law enforcement agency request relates to personal information held in a Protective Services file or surveillance camera tapes of Protective Services, the requesting law enforcement public body must complete the Law Enforcement Disclosure form fully and transmit it to the Director, Protective Services. That office should work with the Information and Privacy Office on the release of information to ensure the severing needed to protect the privacy of other individuals.
The release details should be fully documented in a Note-To-File and that, along with the original Law Enforcement Disclosure form and copies of any released records will be kept on file in the office of record and will be managed according to approved records retention schedules.
G. RELEASE OF INFORMATION – SUBPOENAS/WARRANTS/COURT ORDERS
The university may disclose personal information for the purposes of complying with a subpoena, warrant or order made by a court or a person having jurisdiction to compel the production of information or with a rule of court that relates to the production of information.
The university cannot disclose personal information pursuant to a subpoena, warrant or order issued by a court, person or body having no jurisdiction in Alberta to compel the production of information. If the university does so "wilfully", it could be subject to a fine of not less than $200,000 and up to $500,000.
Any demand for information for records based on the above criteria should immediately be brought to the attention of General Counsel and the Information and Privacy Office.
H. RELEASE OF INFORMATION TO COMPLY WITH LEGAL REQUESTS
Releases of information to comply with legal requests should follow the same procedures as though it were an informal request from the individual but with special considerations relating to the Rules of Court. Care must be exercised to ensure that we are in possession of a valid Authorization-to-Release and that we are confident in the identity of the individual concerned, that the records are for the specified individual, and that the university is not a party to the legal action. When any doubt exists as to what information to release, bring the request to the immediate attention of the Information and Privacy Office. Responses to legal requests often require severing and should involve the Information and Privacy Office.
I. RELEASE OF PERSONAL INFORMATION TO GOVERNMENT INVESTIGATORS
Except in the rare instances where such requests meet the criteria of emergency contact or releases to avert or minimize danger to the health or safety of individuals, requests for personal information by investigators of the federal or provincial governments should be made in writing to the Registrar (for student information) or the Vice-Provost and Vice-President Human Resources (for staff information). Those offices will work with the Information and Privacy Office to prepare a response.
J. RELEASE OF PERSONAL INFORMATION OF DECEASED PERSONS
Privacy rights do not cease upon the death of an individual. Personal information, the disclosure of which is not an unreasonable invasion of the deceased’s personal privacy may be released to the surviving spouse or adult interdependent partner or relative of the deceased individual or to the individual’s personal representative in matters of right or power to administer the individual’s estate. Such requests should be vetted through the Information and Privacy Office.
DEFINITIONS OF PERSONAL & RECORDED INFORMATION - (s. 1(n) and (q) of the Act)
"Personal Information" means recorded information ** about an identifiable individual including:
name, home or business address or home or business telephone number;
race, national or ethic origin, colour or religious or political beliefs, or associations;
age, sex, marital status or family status;
an identifying number, symbol or other particular assigned to the individual;
fingerprints, other biometric information, blood type, genetic information, or inheritable characteristics;
health or health care history, including information about a mental or physical disability;
educational, financial or employment or criminal history; including criminal records if a pardon was granted;
anyone else's opinion about the individual, and
the individual's personal views or opinions, except if they are about someone else.
** "Recorded information" may be in any form and may include, but is not limited to: papers, notes, documents, images, photographs, and voice and audiovisual recordings.
January 16, 2014