Procedure 20-5

Handling Access to Information Requests

Date and Instance of Approval:

2011-12-21
Secretary-General of the University

Amendments:

2024-10-23
2018-04-10

Responsible Service: Access to Information and Privacy Office

PURPOSE

The purpose of this Procedure is to set out the procedures for handling access to information requests under the FIPPA or other Applicable Access and Privacy Legislation.

INTERPRETATION

This Procedure shall be read in a manner that is consistent with the University’s obligations under FIPPA and other Applicable Access and Privacy Legislation, as well as Policy 90 – Access to Information and Protection of Privacy.
Capitalized words or expressions used in this Procedure are defined in Policy 90 or in this Procedure.

BASIC STEPS

The steps in processing an Access Request may vary depending on its nature. There may also be Other Considerations taken into account by the Chief Privacy Officer (“CPO”) that may require additional steps before the CPO decides whether to release any records. Generally, the steps in processing an Access Request are as follows:
1. Filing an Access Request: An Access Request means a formal written request for access to general or Personal Information under FIPPA (“Access Request”). An Access Request shall be submitted in writing, addressed to the Access to Information and Privacy Office (“AIPO”) and must provide sufficient detail to enable AIPO to identify the records sought. The person submitting the Access Request (“Requester”) shall pay the initial fee (see “Fees” below) and either complete and sign the prescribed Access Request Form (PDF, 489 Kb) or set out in writing the following:
  1. a confirmation that the Access Request is made under FIPPA;
  2. a description of the nature of the records sought;
  3. the time period to which the records sought may relate;
  4.  information or suggestions regarding locations, offices, or academic or administrative units in which the records sought may be found; and
  5. potential key search words that may be used when conducting a search for the records sought.
2. Acknowledgment of receipt: The AIPO opens a file and an acknowledgement letter is sent to the Requester.
3. Search for records: The AIPO contacts staff within the relevant academic or administrative unit or office to require that a search for records responsive to the Access Request be conducted. The AIPO shall assist staff by making suggestions on how to conduct the search. Staff are encouraged to seek guidance from the AIPO if it is likely that the search will yield a large number of records, if there are any foreseen complications in conducting the search, or if there are questions or concerns related to the Access Request.
4. Review of records: The records identified as a result of the search are sent to the AIPO. The AIPO reviews all such records to determine whether any exemptions and/or exclusions pursuant to FIPPA apply and will contact the staff involved in conducting the search for any clarifications as necessary. There may be Other Considerations that the AIPO may take into before proceeding.
5. Preparation of records: After the AIPO reviews the records and assesses whether there are any applicable exemptions and/or exclusions under FIPPA, the AIPO prepares the records for release.
6. Decision letter: The CPO issues a letter to the Requester informing the Requester of the CPO’s decision whether to release the records in part or in their entirety and the fees associated with the release of the records (see “Fees” below). Where applicable the CPO also informs any Affected Third Party of the CPO’s decision whether to release the records in part or in their entirety.
7. Release of records: Once the Requester pays the fees associated with the Access Request (see “Fees” below), the AIPO sends a copy of the responsive records in accordance with the decision letter.
8. Appeal: If the Requester disagrees with the CPO’s decision, the Requester may file an appeal with the Information and Privacy Commissioner (“IPC”) pursuant to FIPPA. An Affected Third Party may also appeal a decision made by the CPO in respect of an Access Request. In all cases, the appeal is to the IPC and shall be made in writing to the IPC within 30 consecutive days from the date of the decision letter. The CPO shall participate in any mediation conducted by the IPC and respond to the issues on appeal.
9. File closed: The AIPO shall close the Access Request upon its completion or final disposition by the IPC on appeal, or if the Requester:
  1. has not provided the AIPO with sufficient clarification regarding the scope of the Access Request following the AIPO’s request for such clarification;
  2. has not paid in full the fees associated with the Access Request;
  3. has not filed an appeal of a decision with the IPC within the prescribed appeal period or has exhausted all rights of appeal to the IPC; or
  4. has not responded to correspondence from the AIPO within 30 consecutive days from the date of the correspondence.

OTHER CONSIDERATIONS

Notwithstanding the basic steps outlined above, Other Considerations may cause the CPO to change the order of or otherwise vary the basic steps outlined above, including, but without limitation:
1. Frivolous or vexatious requests: The CPO may deny an Access Request which in the CPO’s view is frivolous or vexatious. In such cases, the CPO shall notify the Requester of his or her decision, including reasons, and inform the Requester of his or her right of appeal to the IPC.
2. Verification of the identity of the Requester: The AIPO may ask for verification of the identity of a person seeking access to his or her own Personal Information before giving the person access to such information.
3. Clarification of an Access Request: If the Access Request is not sufficiently clear or is so broad in scope that it is difficult to identify the records being requested, the CPO may write to the Requester seeking clarification before taking further steps. The Requester shall have 30 consecutive days from the date of the CPO’s letter to clarify the Access Request. If there is no response, the Access Request shall be considered abandoned and the AIPO shall close the file.
4. Exemptions and exclusions: There are certain types of records that come within the scope of FIPPA but may be exempt from disclosure, which include: to protect the public interest, the protection of privacy, University operations or other important interests. In other instances, a record may be entirely excluded from the scope of FIPPA. The AIPO may consult with staff in the relevant academic or administrative unit or office that are familiar with the content of the records to gain a better understanding of whether exemptions or exclusions may apply to all or part of the records.
5. Notice to an affected person or affected third party: Some records responsive to a request may contain information concerning an affected party, such as a person other than the requester. In these instances, the University will provide notice to the affected person or third party. If the CPO intends to disclose a record containing a third-party interest, the CPO shall send a letter to the affected person or affected third party inviting them to send written comments to the CPO regarding potential release of the record; as well enclosing a copy of the record(s) at issue. The CPO shall consider the comments sent by the affected person or affected third party in the decision with respect to the release of the record. Ultimately, the CPO shall decide whether, or not, to release the information contained in the record and shall do so within the time prescribed by FIPPA. The CPO will inform the affected person or affected third party of the CPO’s decision and of their right to appeal the decision to the IPC.
6. Interim access decisions: The CPO may issue an Interim Access Decision pertaining to a fee estimate associated with fulfillment of the Access Request. The fee estimate is based on a representative sample of responsive records and/or the advice of knowledgeable staff that are familiar with the type and content of the records sought. In such cases the CPO shall require payment of a deposit equivalent to 50% of the fee estimate before taking any further steps in processing the Access Request.

DEADLINES AND EXTENSIONS

Access requests must generally be completed within 30 days. The 30-day time limit starts the day the University receives an Access Request that meets the requirements in section 4(a); and finishes the day the final decision letter is sent. If the time limit expires on a Saturday, Sunday, statutory holiday or a day the University is closed, the timeframe for responding to the requester is extended to the next business day the University is open. The day the request is received is considered day zero. If a request is received after business hours, it is considered to have been received the next business day the University is open. AIPO’s business hours are 8:45 a.m. to 5:00 p.m. from September to May and 8:45 a.m. to 4:00 p.m. from June to August.
In the case of an Interim Access Decision, the 30-day time period will be suspended until AIPO receives payment in full of the deposit, at which time the 30-day time period will resume.
The CPO may, in appropriate circumstances, extend the 30-day deadline in accordance with FIPPA and shall notify the Requester in writing of any such extension of time. The CPO will extend the time period where an Access Request requires an extensive search of records; yields a large amount of records; or requires consultation with an Affected Person or an Affected Third Party.

FEES

FFIPPA allows the University to charge fees for the processing of Access Requests. An initial non- refundable fee shall be paid before the CPO begins to process the Access Request. Records shall not be released until the CPO receives payment in full of all fees associated with the Access Request.
Fees must be paid with cash, certified cheque, money order, or by an electronic payment through AIPO’s eStore.
Information on fees shall be posted on the AIPO’s website.
If a Requester asks the CPO to waive the fee associated with an Access Request, the CPO shall consider whether it is fair and equitable to do so in the circumstances. Consideration may include: financial hardship; public health and safety benefits and any other matter required by FIPPA. If the CPO decides not to waive the fee, they will notify the Requester of their decision, and of their right to appeal the decision to the IPC.