Purpose
Access and Privacy at NorQuest College has two purposes:
- to support the right of access to records in the custody or control of the college, subject to limited and specific exceptions; and
- to protect personal information, non-personal data, and data derived from personal information by regulating how the college collects, uses, and discloses such information.
Key principles
Access and privacy at the college are guided by six key principles under two laws:
Access to Information Act (ATIA):
- Anyone can access records that the college owns or manages, with some limitations.
- Anyone can access college records about themselves, with some limitations.
Protection of Privacy Act (POPA):
- Anyone can ask to correct college records about themselves.
- The college must control and protect the personal information it asks for, receives, uses, and gives out.
- The college must control and protect the non-personal data and data derived from personal information it creates, uses, and gives out.
- Anyone can ask the Alberta Information and Privacy Commissioner to review a college decision made under ATIA and POPA.
Privacy Management Program (PMP)
Under the Protection of Privacy Act, the College must have a Privacy Management Program (PMP).
A PMP is an evolving collection of policies, procedures, and tools that help protect personal information and its derivatives, allowing the College to remain compliant with its obligations under POPA.
Below are the key components of NorQuest College’s Privacy Management Program.
Governance
Under the ATIA and POPA, the President and CEO of NorQuest College is the designated head of the college.
The head asks college experts to make decisions and take action under the FOIP Act through the NorQuest College Delegation Matrix.
College policies and procedures
The college uses procedures to help guide employees and partners on best access to information and privacy practices.
- Access and Privacy Policy
- Access to Information Procedure
- Data Matching and Non-Personal Data Procedure
- Privacy Breach Reporting Procedure
- Protection of Privacy Procedure
Other relevant policies and procedures include:
- Acceptable Use Standard
- Archives Policy
- Code of Conduct Policy
- Digital Security Policy
- Disclosure of Travel and Expenses Policy
- Ethical Conduct for Research Involving Human Participants Policy
- Generative Artificial Intelligence Policy
- Photography/Media Consent and Release Form Procedure
- Records and Information Management Policy
- Records Lifecycle Procedure
- Security Incident Response
Request access to information
Individuals can request access to personal information in college records.
Refer to the Access to Information Procedure for details.
Submit a Request to Access Information form to ask for limited access to this information.
Request to correct personal information
Anyone who thinks there is an error in a record about them that the college owns or manages should:
- Contact the business area that asked for the personal information and ask for a correction.
- If the business area cannot correct the information, complete a
Sign the completed form with the following information:
- A full description of the personal information to be corrected.
- The reason for the correction.
- Evidence that supports the correction.
Submit the signed form, and the college will consider the request and provide a written response.
Training
All employees take the Information: Access and Privacy course created by the college. The course covers:
- Best privacy practices and an outline of the POPA and ATIA
- Asking for, receiving, using, and giving out personal information
- Keeping, fixing, and caring for personal information over time
- Protecting and releasing personal records, and non-personal data, and data derived from personal information
- Creating and using non-personal data, and data derived from personal information
Successful course completion is part of the hiring process at the college.
Need-based and ad hoc training is also offered on specific topics, and employees are encouraged to continue growing their knowledge of access and privacy by exploring training opportunities offered by other organizations.
Personal information bank directory
A personal information bank (PIB) (AKA, personal information inventory) is a directory of personal information that the college requires to provide services. This directory can include any name, identifying number, symbol, or remark about an individual.
A PIB only details what type of personal information the college asks for, uses, and gives out. It includes:
- The legal authority for the collection of personal information.
- The operational reason for the collection of the personal information.
- A description of the kind of personal information contained in the collection.
- The title and location of the PIB.
Access the NorQuest College Personal information bank directory.
Resources
ATIA and regulation
POPA and regulations
- Protection of Privacy Act
- Protection of Privacy Regulation
- Protection of Privacy (Ministerial) Regulation