Privacy Management Program
General Information:
Section 25(1) of the Protection of Privacy Act (“POPA”), requires the head of a public body to develop a privacy management program for the public body and to do so in accordance with the Protection of Privacy (Ministerial) Regulation. The following is an overview of the University of Lethbridge’s privacy management program. The Privacy Management Program will be reviewed annually.
Privacy Governance:
Requirement: The head of a public body must designate/identify an individual(s) as the Privacy Officer for the public body. The Privacy Officer is responsible for ensuring the public’s body’s compliance with POPA and its regulations.
The head of University of Lethbridge is the Vice-President, Finance and Administration. The Vice-President, Finance and Administration has delegated some of the duties of the head to the Privacy Officer, including being a point of contact for privacy-related matters, supporting the development, implementation and maintenance of privacy policies and/or procedures and supporting the university’s compliance with POPA. See Delegation Tables below.
Privacy Impact Assessments:
Requirement: POPA requires public bodies to have a process for completing and documenting privacy impact assessment (PIAs) for all new, or in the event of a substantial change to existing, administrative practice, program or project or service that involves the collection, use or disclosure of personal information.
PIAs provide a formal way to review initiatives that collect, use and disclose personal information along with applicable risk mitigation strategies employed to protect the privacy of individuals.
The University of Lethbridge has implemented a risk-based approach to conducting PIAs. A PIA is typically completed with the help of the individuals working on the initiative. Should there be any changes to the technology initiative after the PIA is completed, a reassessment will be carried out to determine if any changes need to be made. Please note, that in some situations, the University of Lethbridge will submit a PIA to the Office of the Privacy and Information Commissioner for its review.
The Privacy Impact Assessment can be found on the Privacy Office website here or by emailing privacy@uelth.ca.
The below four questions can assist departments in determining whether a PIA is required for the initiative:
With this software, are you collecting or storing any personally identifiable information?
Does the software have a cloud storage component?
Does the product integrate with any other university systems?
Will any of the information collected be used to train AI algorithms or large language models?
Security Classification Levels:
Security Class
Definition
Sensitivity
Public (formerly Unrestricted)
(Level 1)
Information or data that is (or can be) generally available to all employees, the general public, and/or the media. This classification does not mean that the information should be published in all situations.
Examples include: policies, campus maps, aggregated student demographic data, publications
Unintended disclosure of this information will result in no or minimal harm, injury, or inconvenience to individual, group, or institutional operations, assets, or reputations.
Internal
(Level 2)
Information or data that is proprietary or sensitive outside the University of Lethbridge, and needs to be protected. Availability limited to members of the University community with a clear business-related need for access as part of their employment, academic, or contractual duties and responsibilities.
Examples include: aggregated and anonymized demographic information, curriculum development documents, planning documents, enrolment reports, student university email addresses, intranet publications.
Unintended disclosure of this information has minimal or no effect on an individual, group, or institutional operations, assets, or reputation.
Limited
(Level 3)
Information or data of a sensitive or confidential nature that is protected from general internal distribution. This information may be subject to specific privacy and security safeguards under law, policy, or contractual agreement. Availability limited to individuals in specific job functions with a business-related need to know.
Examples include: most personally identifiable information, personnel records, financial records, student academic records, exams, detailed floor plans, private team content.
Unintended disclosure of this information could have a significant negative effect on an individual, a group, or institutional operations, assets, or reputation. It may compromise the University’s legal position, and/or obligate the University to report to a regulatory body, and/or provide notice to affected individuals.
Restricted
(Level 4)
Information or data of a highly sensitive or confidential nature that is intended for restricted internal use. It may be subject to specific privacy and security safeguards under law, policy, or contractual agreement. Availability limited to specific, named individuals or positions with legitimate, business-related need for access.
Examples include: legal proceedings, health information, human subject research data, payment card information, passwords, encryption keys, and access codes.
Unintended disclosure of this information is serious and has severe adverse effect on individuals, groups, or institutional operations, assets, or reputation. It may compromise the University’s legal rights, and/or obligate the University to report to a regulatory body, and/or provide notice to affected individuals.
Privacy Complaint and Breach Process:
A privacy breach is the result of unauthorized access to, or collection, use, or disclosure of personal information. Such activity is unauthorized if it occurs in contravention to the Protection of Privacy Act. Some of the most common privacy breaches happen when personal information is stolen, lost, or mistakenly disclosed.
If you have discovered or are aware of a privacy breach, please fill out this form. You may also notify the Privacy Office at privacy@uleth.ca or 403-332-4620, so the breach can be contained and the risk can be assessed.
Please be advised that if the head and the Privacy Officer determine that a significant data breach has occurred or whether there exists a real risk of significant harm to an individual as a result of the loss of, unauthorized access to or unauthorized disclosure of personal information, it will be reported to the Office of Information and Privacy Commissioner (OIPC) in accordance with the POPA Regulations.
Correction of Personal Information:
Alberta’s Protection of Privacy Act (POPA) provides a legal right for individuals to request a correction of personal information held by the University of Lethbridge. If an individual believes that their personal information, in the custody of the University of Lethbridge, contains an error or omission, they may request the University of Lethbridge to correct the personal information.
Requests for corrections of personal information can be made for factual information, not opinions about the individual. To request a correction to personal information, please email privacy@uleth.ca
Automated Systems:
The University of Lethbridge may utilize automated systems and artificial intelligence to the extent allowable in accordance with ATIA and POPA. When an individual’s personal information may be input into an automated system to generate content, make decisions, recommendations, or predictions, the individual must be aware of this at the time of collection.
Non-Personal Data & Data Matching:
To establish consistent processes for the creation, use and disclosure of non-personal data in accordance with the Protection of Privacy Act (POPA).
Data Matching
Data matching involves the linking of personal information across two or more databases, or other electronic data sources, to generate data derived from personal information.
In accordance with POPA, a public body may carry out data matching to create data derived from personal information only for one or more of the following purposes:
(a) Research and analysis;
(b) Planning, administering, delivering, managing, monitoring or evaluating a program or service;
(c) One or more prescribed purposes.
Data for data matching must not be collected directly from the individual. Data can only be used if:
(a) The data is collected from another public body;
(b) The data is personal information that is already in the University’s custody or under its control.
Any practice, program, project or service that involves data matching between two or more public bodies requires a privacy impact assessment (PIA) to be prepared.
As soon as reasonably practicable after a public body has finished using data derived from personal information created through data matching process for the purpose it was created, the public body must destroy the data or transform it into non-personal data.
Non-Personal Data
In accordance with POPA, a public body may create non-personal data only for one or more of the following purposes:
(a) Research and analysis;
(b) Planning, administering, delivering, managing, monitoring or evaluating a program or service;
(c) One or more prescribed purposes.
For the purposes of creating non-personal data, a public body may use the following only if it is in the custody or under the control of the public body:
(a) Personal information;
(b) Data derived from personal information.
When creating non-personal data, the public body must maintain a record of the following:
(a) A description of the personal information or data derived from personal information used to create the non-personal data;
(b) The purpose for creating the non-personal data;
(c) The method used for creating the non-personal data;
(d) The assessment done to ensure that the identity of the individual who is the subject of the non-personal data cannot be identified or re-identified from the data.
The Non-Personal Data Creation Record can be found here.
Personal Information Banks:
Requirement: Section 57 of POPA requires public bodies to publish a directory, in printed or electronic form, that lists the public body’s personal information banks.
A Personal Information Bank (PIB) is a collection of the types of personal information held by the University of Lethbridge. The purpose of a PIB is to help the public know and understand what personal information the University of Lethbridge might have about them as individuals.
The University of Lethbridge’s Personal Information Bank listing can be found here.
Please note, that a PIB directory is a living document; entries in the PIB are added, modified, and deleted on an ongoing basis as records change.
Applicable Policies and Procedures
The University of Lethbridge’s Policies and Procedures can be found here.
Some of the POPA related policies and procedures are linked below:
Delegation Tables
ATIA Delegation Table
POPA Delegation Table