1. Definitions:

In this policy:

• "Act" means The Local Authority Freedom of Information and Protection of Privacy Act;
• "Authorized Employee" means an employee, member of faculty or any other staff member of the University whose position and/or duties require regular or periodic access to Personal Information in the custody or under the control of the University;
• "Personal Information" means personal information about an identifiable individual that is recorded in any form, as defined by section 23 of the Act;
• "Regulations" means the regulations made by the Lieutenant Governor in Council pursuant to s. 57 of the Act;
• "Request" means an application pursuant to the Act for access records in the possession or under the control of the University;
• "Third Party" means a person, group of persons or organization other than the individual the personal information in question relates to;
• "University" means the University of Saskatchewan.            

2.  Freedom of Information

• Individuals have the right of access to records in the possession or under the control of the University, subject to exemptions set out in the Act.
• Provision of access to a record may be subject to payment of fees set out in the Regulations.
•  The University will continue to provide routine access through existing procedures to information that is in the public domain and/or subject to public disclosure under the Act: i.e. providing access to such information without requiring a formal access to information request in appropriate circumstances.

 3.  Protection of Privacy

a)  Collection of Personal Information

Personal Information will be collected only in the following circumstances:

• when it is necessary for the proper administration of the programs, services or general operations of the U of S;
• when it is expressly authorized or required by an enactment of the Government of Canada or the Province of Saskatchewan; or
• for the purposes of law enforcement.

An employee responsible for collecting Personal Information will be able to provide the reason(s) that the collection of such information is necessary.

To the extent that the employee collecting Personal Information is unable to answer questions regarding the reasons for collection, the person seeking clarification will be directed to another employee who is better suited to respond to the question(s) being asked.

Personal Information about an individual will be collected directly from that individual unless circumstances require that it be obtained from another source.  All Personal Information may be verified by the individual concerned, as outlined in paragraph 3(e) of this policy.

b)  Protection of Personal Information

The U of S, including its employees and agents, will take reasonable and prudent measures to protect Personal Information from unauthorized collection, access, use, disclosure or destruction.

Personal information will only be accessed by Authorized Employees for the purposes outlined in Paragraph 3(c) of this Policy.

Personal information will be stored in a manner which limits access to Authorized Employees only.  This will include: 

•  
  • storing Personal Information in locations which are not generally accessible to all employees and/or the general public;
  • securing the rooms and/or filing cabinets containing Personal Information during those times that an authorized employee/staff member is not present;
  • restricting access to Personal Information that is stored in an electronic format to Authorized Employees by requiring the entry of user names and passwords.

 c)  Use of Personal Information

The University may only use Personal Information: 

•  
  • for the purpose(s) for which it was collected, or for a use consistent with that purpose;
  • in a manner permitted by the Act;
  • for any other purpose provided that the explicit consent for such use is first obtained from the individual to whom the Personal Information relates, or from someone duly authorized to provide such consent on behalf of that individual;

d)  Disclosure of Personal Information

The University will only disclose Personal Information to third parties or allow it to be made public in the following circumstances:

• the disclosure is for a purpose for which the information was obtained or compiled, or for a use consistent with that purpose;
• the disclosure is for a purpose permitted, authorized or required by the Act;
• the disclosure is for a purpose which is expressly authorized or required by another enactment of either the Government of Canada or the Province of Saskatchewan; or
• the explicit consent for the disclosure has been provided by the individual to whom the Personal Information relates, or by someone duly authorized to provide such consent on behalf of that individual.

 e)   Access and Correction of Personal Information

• The University will make reasonable efforts to ensure that all Personal Information in its custody or under its control is as complete and accurate as is required for the purpose(s) for which it was collected.
•  Subject to any exemptions or restrictions set out in the Act, or in any other enactment of either the Government of Canada or the Province of Saskatchewan, individuals shall have the right to access Personal Information about themselves which is in the custody of or under the control of the University. A formal Freedom of Information request will not be required where individuals are seeking access to Personal Information about themselves.
• In addition, in the event that any of the Personal Information in the custody of or under the control of the University is incorrect, incomplete or otherwise inaccurate, the individual to whom that Personal Information relates has the right to request that it be amended or corrected.
• When such corrections have been requested, the University will review and confirm the amendments and provided that it is satisfied that an amendment or correction is warranted, the University will make the necessary amendment or correction as soon as reasonably possible. 

f)  Retention and Disposal of Personal Information

• Personal Information will be retained by the University in accordance with the retention policy applicable to the department, college or administrative unit which has custody of that Personal Information.
• Personal Information that is deemed by the University Archives to be of historical value will be retained on a permanent basis.  Such information will not be disclosed to Third Parties without the consent of the individual to whom the Personal Information relates, or by someone duly authorized to provide such consent on behalf of that individual, until 25 years following the death of that individual.  Disclosure of such Personal Information may occur prior to 25 years after the death of the individual to whom it relates where such disclosure is appropriate and meets the requirements of the Act.
• Once Personal Information is no longer needed for administrative, regulatory, legal or historical reasons, it will be disposed of in the following manner:
  • Paper records shall be destroyed by shredding, incineration or pulping;
  • Electronic records shall be deleted in such a way that the information they contained cannot be recovered using current technology.

g)  Outsourcing

The University may, where it is advisable or necessary for the efficient and proper operation or management of its programs, services or general operations, enter into agreements with external individuals or organizations which allows them access to Personal Information in the custody or under the control of the University.  Any such agreements will include provisions that obligate the external individuals or organizations to ensure that all such Personal Information is protected and any collection, use or disclosure is only carried out in compliance with this policy and the Act.