Confidentiality of Information and Records
Subject: Confidentiality of Information and Records
Issue Date: September 23, 2010
Lambton College gathers, generates and stores information concerning its students ∗,
employees and persons who use services provided by Lambton College. The
information may be comprised of personal information ∗ and academic, employment,
financial and health records*. As the holder of the information and records, the College
has a moral responsibility and a legal obligation under various legislative acts (Canada's
Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's
Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health
Information Protection Act (PHIPA)) to store, use and disseminate the records and
information with appropriate safeguards and in a manner that protects their
confidentiality and respects the privacy of the individual.
Information collected in student records (e.g. academic, discipline, financial, health,
financial aid), in employee records and concerning persons using Lambton College
services will be used to administer the student programs, activities and services of the
College, manage the human resources functions and deliver employee benefits and
services, and generally administer the College.
All Lambton employees are responsible and accountable for maintaining the
confidentiality of all individuals' records and for compliance with this policy when
working with and having access to confidential records and personal information.
The College will use organizational processes and security protocols to ensure the
integrity and confidentiality of the information in its records. The administrator, at the
director or dean level, of the department that stores or uses the personal information
and confidential records shall be responsible and accountable for the implementation
and operation of processes and protocols that ensure the confidentiality of the records
and information, and the privacy of the individuals. Specifically, but not exhaustively,
see definitions page 6
responsibility for the confidentiality of student and financial aid records rests with the
Registrar, for student health records with the Director of Student Success, for financial
records with the Director of Finance, for employee records with the Director of Human
Resources, for video surveillance recordings and other security related information with
the Director of Facilities, and for classroom and laboratory student recordings with the
All records and information concerning a student or employee are considered
confidential and will be released to a third-party only upon the written authorization of
the individual, or with the exceptions described below.
Personal information or confidential records may be released only by the administrator
responsible for the information and records as described above, or designate. e.g. Only
the Registrar may release information concerning a student and her registration status or
The following information constitutes the public record concerning a student: name of
graduate, credential granted, date credential was granted, awards given and date. All
other information is confidential. In the case of a police request arising from an
investigation, the Registrar may make available to the police the name and registration
status of a student.
Public Information concerning an employee arises from the employment role and
consists of name, title, work address, telephone number and work e-mail address.
Lambton College will not sell or rent student or employee personal information to any
organization or person for any reason.
A list of student names or the student directory will not be released except for use
within the institution, for example, Student Administrative Council (SAC) elections.
The College may provide limited personal information to an organization that is
providing for the College a service to the students or employees, e.g. health insurance,
or conducting a mandated or required activity, e.g. Graduate Satisfaction Survey.
The College will also provide limited personal information to the Lambton College
Foundation and the Student Administrative Council for their limited uses.
The College will publish an information statement (see appendix A) describing its
collection and use of student information and provide an avenue for students to seek
additional information or post concerns regarding the gathering and use of the
The College may use video surveillance cameras on College property for the sole
purpose of ensuring the safety and security of students, employees and campus visitors,
and the security of College facilities and property. The video tapes will be considered
confidential and subject to the provisions of this policy.
2000-7-1 Confidentiality of Information and Records Policy Page 2 of 8
The posting of any student grade or evaluation result by student name, student number
or any other identifying symbol or code is strictly prohibited unless the posting is in a
manner that does not lead to the identification of the individual.
Where a student is granted access to her own personal information and disagrees with
the information, she may, in writing, request correction of the information or require
that a statement of disagreement be attached to the information where correction is
refused Student and employee information and records will be retained as described in
Policy 1000-5 Records Retention.
2. Student or Employee Access to Information
A student or employee, upon written request, and verification of identification, shall,
unless the request is deemed frivolous or vexatious,
a. be given access to his own file,
b. be able to release all or part of the file to a third-party, or
c. be able to request that the file be held with no release allowed.
A student or employee may have access to her own file, but may not alter or remove any
of the contents. If the individual disagrees with the content of her record or file, she may
add or append a statement to that effect, with her version of the correct information, that
will then be considered a part of the record.
The College may hold back the release of a student's record, to the student or a third-
party, if there are debts outstanding to the College.
2.1 Exemptions to Access to Information
The College may refuse to disclose a record or part of it:
a. where the disclosure could be reasonably expected to interfere with a law
enforcement or legal matter, or an ongoing internal investigation
b. where disclosure would reveal information received in confidence from another
government body or its agencies,
c. where the information was supplied in confidence, and is evaluative or opinion
material compiled for such purposes as assessing the teaching materials or
research of an individual, determining suitability or eligibility of qualifications
for admission to a program, determining suitability for an honour or award, or
determining suitability, eligibility or qualifications for the awarding of contracts
or employment or other benefits, and where the disclosure would reveal the
identity of the source who furnished information to the College in circumstances
where it was explicitly stated or may reasonably have been assumed that the
identity of the source would be held in confidence,
d. where the disclosure would reveal a trade secret, scientific or Labour Relations
2000-7-1 Confidentiality of Information and Records Policy Page 3 of 8
e. where disclosure would reveal information relating to specific tests or testing
procedures or techniques that are to be used for educational purpose,
f. where it is subject to solicitor-client privilege,
g. where the refusal is in accordance with any of the exemptions contained in the
acts and their regulations.
3. Release of Information
Employees of the College, who have a valid working requirement for some or all of a
record or personal information, will be permitted access to the appropriate files.
4. Disclosure of Information to a Third-Party
The College shall refuse to disclose confidential personal information or records to any
third-party individual, agency or organization except upon the prior written request or
consent of the individual, with the exceptions noted below.
Consent for the disclosure must be provided by the individual in a written or printed
format with an original signature, or equivalent legal documentation.
Confidential personal information and records will be released posthumously only with
the authorization of the President.
Because the College views each student as an adult, information or records will be
released to a parent only with explicit student consent.
4.0.2 Sponsoring or Funding Agencies
The College will provide information or records concerning a student on the request of
the agency only with the written authorization of the student.
4.0.3 Police and Courts
In the event that a student record or information is subpoenaed by a court on behalf of
the student, a certified copy of the requested student record or information will be
offered. Should the record or information be subpoenaed by a party other than the
student, or a party representing the student, a certified copy of the record or information
will be provided to the judge alone, with an explanation of the College's reluctance to
release a private record or information without student authorization. The decision will
then rest with the judge.
No private information or record will be released to the police without a subpoena. The
public record, described above, may be provided.
4.0.4 Government Agents
Confidential personal information and records will not be released to government
agents or agencies without the prior written consent of the individual, unless, directed
2000-7-1 Confidentiality of Information and Records Policy Page 4 of 8
by law, such as under the Employment Insurance Act or the Federal Statistics Act, and
then only that information specifically requested will be released.
Requests from external researchers undertaking statistical studies for personal
information and records must be approved by the President, or his designate, under
conditions that protect the individual's privacy, guarantee the anonymity of the data
collected and are consistent with the ruling of the Research Ethics Board. Only that
information specifically requested will be released.
4.1 Exemptions to Limits on Disclosure of Information to a
In certain compelling circumstances, affecting the health, safety or security of an
individual or the College, or otherwise in accordance with provisions of the acts and
their regulations, exceptions may be made to the above prohibition on the release of
personal information or records.
The health, safety or security of an individual or the College may take precedence over
the confidentiality of information and records, and the privacy of an individual. In
those instances in which there is a serious threat of danger to a person or persons or the
institution, the College may disclose confidential information about a student or
employee to an appropriate health or security agency or immediate family member. See
Policy 4000-3-6 Disclosure of Information in Event of Emergency.
If, in the opinion of the Registrar, denial of requested information is likely to result in
undue hardship to the student, appropriate details of personal information or records
may be released. Such a release will be considered a breach of confidentiality and
treated as such as described below.
In the case of video surveillance data, access, based on an identified need, may be
granted to appropriate College personal by the Director, Facilities Management. Release
of video surveillance data to outside agencies, including police, may occur only in cases
affecting the safety or security of persons on campus or College facilities, and must be
authorized by the President or designate.
5. Breach of Confidentiality
Breach of confidentiality includes any intentional or inadvertent unauthorized access to,
or disclosure of, confidential information or records. It is not a breach of confidentiality,
for example, to disclose information permitted or required by law, or to provide student
or employee information for a research study as long as the individual is not
Any employee who becomes aware of a breach of confidentiality must immediately
inform the administrator (director, dean, Registrar) responsible for the records.
2000-7-1 Confidentiality of Information and Records Policy Page 5 of 8
The responsible administrator shall immediately inform the relevant vice-president of
the breach and, subsequently, steps taken to address the damage done and prevent
The responsible administrator shall immediately inform the individual(s) affected by the
breach of the incident. The individual will also be informed of any measures being
undertaken to address the breach.
The administrator shall attempt to remedy any damage created for the individual by the
breach and mitigate any damage caused to the College.
The administrator shall develop and implement process or protocols to prevent any
further such breaches.
Student includes persons currently registered as full- or part-time students and, where
relevant, may be construed to include past registrants including graduates, and
applicants who have not, or do not, attain registered student status.
Record means any records of information however recorded (in print, on film,
electronically, etc.) and includes, but is not limited to, the following: a student file, an
employee file, correspondence, e-mail, memorandum, a drawing, photograph, a sound
recording, a video recording.
Personal Information is information about an identifiable individual. It includes, but is
not limited to, the following: gender, age, sexual orientation, marital or family status,
race, national or ethnic origin, information related to employment, information related
to educational history, information related to medical, psychiatric, or psychological
history, prognosis, condition, treatment or evaluation, social insurance number (SIN),
student number, home address, telephone number, personal opinions of or about an
individual, correspondence from, to or about an individual that is implicitly or explicitly
of a private nature.
2000-7-1 Confidentiality of Information and Records Policy Page 6 of 8
Lambton College Statement on Collection of Personal Information and
Protection of Privacy
Lambton College collects and retains personal information about students, alumni, employees
and persons who use services provided by Lambton College. This information is used for the
academic, administrative, employment-related, financial and statistical purposes of the College.
The information will be used, among other things, to
• admit, register and graduate students,
• record academic achievement,
• provide access to information systems,
• operate various College programs and services,
• administer the College,
• provide services, sometimes through third parties, such as health and dental insurance.
Lambton College may collect personal information from other relevant sources such as the
Ontario College Application Centre, secondary schools, colleges, universities and other
institutions previously attended and third-party services and test score providers where the
information collected forms a part of an application, admission or evaluation process.
Information on admissions, registration and academic achievement may be disclosed and used
for statistical and research purposes by the College, other post-secondary educational institutions
and the federal and provincial governments.
The names of alumni, their program, award information, credential(s) awarded and date of
graduation are considered public information and may be published by Lambton College.
Student photographs posted by the College in the form of individual pictures or class pictures
may be publicly displayed.
Aside from the foregoing, the information you provide and any other information placed in a
student or personnel record will be protected and used in compliance with Ontario’s Freedom of
Information and Protection of Privacy Act (RSO 1990) and will be disclosed only in accordance with
this Act. If you have any questions about the collection and use of this information please
contact the College Registrar.
Lambton College provides specific, limited personal information to the Lambton College Student
Government. The Student Government uses personal information for the purpose of
membership, administration, elections, annual general meetings, health plans and other related
matters only. Please contact the relevant Student Government office if you have questions
about this use and disclosure of your personal information and their privacy policies.
Lambton College provides specific, limited personal information to the Lambton College
Foundation and the subsidiary Lambton College Alumni Association. The Foundation and
Association use personal information for the purpose of membership, administration, and
2000-7-1 Confidentiality of Information and Records Policy Page 7 of 8
fundraising related matters only. Please contact the Foundation if you have questions about
their use of your personal information and their privacy policies.
2000-7-1 Confidentiality of Information and Records Policy Page 8 of 8