Procedure for Handling Access to Information and Correction Requests

The purpose of this Procedure is to establish the procedures for handling requests to access to information under the custody or control of Laurentian University of Sudbury (the “University”) and requests to access and correction of one’s personal information  under the Freedom of Information and Protection of Privacy Act (FIPPA), and other applicable access and privacy legislation including the Personal Health Information Protection Act (PHIPA) and Personal Information Protection and Electronic Documents Act (PIPEDA).

It is not always necessary to file a formal request under the applicable legislation, as the University provides information to the public through a number of its academic and administrative departments. Informal inquiries are welcomed and will be dealt with by the appropriate department heads. Faculty and staff are encouraged to release general information, respond to routine inquiries, and provide copies of records as appropriate while respecting the need to protect privacy.

FIPPA: Individuals have the right to request access to records of general information in the custody or control of the University, subject to certain exemptions and exclusions set out in FIPPA. They also have the right to request access to, and correction of, records of their own personal information in the custody or control of the University, subject to certain exemptions and exclusions set out in FIPPA.

PIPEDA: PIPEDA grants individuals a right of access to their personal information that was collected by the University in relation to commercial activities, such as operating a parking garage, the University bookstore, or a university coffee shop.

PHIPA: There is a similar right of access and right of correction pertaining to records of personal health information under PHIPA, applicable where the University processes personal health information to provide health care or to support its research and teaching mission. Below is a step-by-step guide for submitting a formal access or correction request under the applicable privacy legislation.

Upon receipt of a request, the UIPC will send an acknowledgement letter to the requester.

1. Access requests
   • i) Requests for clarification: If a request does not sufficiently describe the information sought, the UIPC will contact the requester for clarification. If the requester has not responded to a request for clarification after 30 days, the UIPC may write to the requester advising that the file may be considered abandoned, and subsequently closed, unless the requester responds by a specified date.
      
   • ii) Searching responsive records: The UIPC will contact staff within the relevant academic or administrative units, or health information custodian’s office, to ask that a search for records responsive to the request be conducted.
     
     The UIPC will work with relevant staff knowledgeable in the subject matter of the request to determine how best to conduct the search and the extent of any fees to be charged under the relevant legislation (see section 5, below). If a Fee Estimate is required, the UIPC will prepare the Fee Estimate and advise the requester of any deposit to be made prior to the University processing the request. If required, the UIPC will also prepare an Interim Access Decision at this time.
     
     Once a deposit has been paid, if required, and responsive records have been identified, the UIPC will review the records to determine whether: 
     • any statutory exemptions, exclusions, or exceptions apply to the requested records; and
     • whether there is a need to notify interested third parties (organizations) or affected parties (individuals).
        
   • iii) Notifying affected third parties: If the UIPC determines that there is a need to notify third or affected parties of the access request, they will do so in writing. In notifying these parties, the UIPC will enclose a copy of the requested record(s), and invite the third or affected party to provide written comments regarding the potential release of the record(s). If an interested third party or affected party provides submissions, the UIPC will consider them before making their decision.
     
     The UIPC will prepare the records for release, as required.
      
   • iv) Decision letters: The UIPC will prepare a decision letter, which will be sent to the requester by mail. The University’s decision letter will inform the requester of the University’s access decision and, if applicable, the fee to be paid before access is granted (see section 5). Where applicable, the UIPC will also inform any third or affected parties of their decision to release the records in part or in their entirety. If the affected or third parties object to the decision, they will have 30 days to appeal the University’s decision to the Office of the Information and Privacy Commissioner of Ontario (IPC).
     
     Once the requester pays the required fees, and the required 30 day period has passed, if applicable, the UIPC will send a copy of the responsive records to the requester in accordance with the University’s access decision.
     
     Under certain circumstances, the UIPC may determine that a request is frivolous or vexatious, as contemplated by FIPPA and PHIPA. In such cases, they may decline to provide access to requested records. In doing so, the UIPC will notify the requester of their decision, give reasons for which the request is considered frivolous or vexatious, and inform the requester of their right of appeal to the IPC.
      
2. Correction requests
   • If a request does not sufficiently describe the desired correction, the UIPC will contact the requester for clarification. If the requester has not responded to a request for clarification after 30 days, the UIPC may write to the requester advising that the file may be considered abandoned, and subsequently closed, unless the requester responds by a specified date.
     
     In deciding whether to grant a correction request, the UIPC must determine whether the information submitted for correction can be verified. In some cases, the UIPC will require documentary proof to support a request. Corrections are typically only made to personal information that is incomplete or incorrect; evaluations or opinions are not usually corrected. The UIPC will prepare a decision letter, which will be sent to the requester by mail.
      
3. Timeline for a response
   • ​​​​​​​​​​​​​​The University will make every reasonable effort to respond to an access or correction request within 30 calendar days of receipt, as prescribed by FIPPA, PHIPA and PIPEDA. However, the University may extend this deadline in accordance with the Acts. Requesters will be given notice in writing of any time extensions. Requesters may ask the IPC to review a time extension.

FIPPA

As specified in FIPPA Regulation 460, RRO 1990 the following fees may apply to an access request under FIPPA:

Fees for access to personal information under FIPPA

Fees for access to general information under FIPPA

PHIPA

There is currently no regulation prescribing the fee for providing access to an individual’s records of personal health information under PHIPA. However, the IPC has consistently applied the following fee scheme set out in a proposed regulation to PHIPA, published by the Minister of Health and Long-Term Care in 2006, though never adopted: 

Fees for access to records 

1. For the purposes of subsection 54 (11)  of [PHIPA], the amount of the fee that may be charged to an individual shall not exceed $30 for any or all of the following:
   1. Receipt and clarification, if necessary, of a request for a record.
   2. Providing an estimate of the fee that will be payable under subsection 54(10) of [PHIPA] in connection with the request.
   3. Locating and retrieving the record.
   4. Review of the contents of the record for not more than 15 minutes by the health information custodian or an agent of the custodian to determine if the record contains personal health information to which access may be refused.
   5. Preparation of a response letter to the individual.
   6. Preparation of the record for photocopying, printing or electronic transmission.
   7. Photocopying the record to a maximum of the first 20 pages or printing the record, if it is stored in electronic form, to a maximum of the first 20 pages, excluding the printing of photographs from photographs stored in electronic form.
   8. Packaging of the photocopied or printed copy of the record for shipping or faxing.
   9. If the record is stored in electronic form, electronically transmitting a copy of the electronic record instead of printing a copy of the record and shipping or faxing the printed copy.
   10. The cost of faxing a copy of the record to a fax number in Ontario or mailing a copy of the record by ordinary mail to an address in Canada.
   11. Supervising the individual’s examination of the original record for not more than 15 minutes.
        
2. In addition to the fee charged under subsection (1), fees for the services set out in Column 1 of Table 1 shall not, for the purposes of subsection 54(11) of PHIPA exceed the amounts set out opposite the service in Column 2 of the Table.

*The fees for service in the above Table are subject to change in accordance with PHIPA and it’s Regulations.

The University adopts this fee scheme for the purposes of PHIPA access requests until such time
as the IPC instructs otherwise.

PIPEDA

PIPEDA stipulates that organizations, such as the University, must provide access to personal information at minimal or no cost to the individual. The University must notify the requester of the approximate cost before processing a request.

Fee deposit

Under FIPPA, the University may require a requester to pay a fee deposit 50% of the total estimated fee if it is $100 or more before processing a request. The University will refund any fee deposit paid that is subsequently waived.

If a requester or a third or affected party is not satisfied with the University’s access or correction decision, they may appeal the decision to the Information and Privacy Commissioner of Ontario. An appeal must be filed within 30 days of receiving the University’s decision.  The UIPC will participate in any appeal process, on behalf of the University. More information about filing appeals with the IPC is available here.

The IPC’s contact information is as follows:

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario
M4W 1A8
Telephone: 1-800-387-0073
Fax: (416) 325-9195
Email: info@ipc.on.ca

The UIPC will close an access or correction request file upon its completion, or upon a final disposition by the IPC on appeal.

Alternatively, a file may be closed if the requester:

Has not provided the UIPC with sufficient clarification regarding the scope of their access or correction request, following the UIPC’s request for such clarification; Has not paid the fees associated with an access request in full;

Has not filed an appeal of an access or correction decision with the IPC within the prescribed 30day appeal period, or has exhausted all rights of appeal;

or Has not responded within the specified timeframe to correspondence from the UIPC advising that a file may be considered abandoned.