Freedom of Information and Protection of Privacy Policy

Vancouver Community College (VCC; the College), as a public post-secondary institution in British Columbia, is subject to the BC Freedom of Information and Protection of Privacy Act (the Act; FIPPA). VCC is committed to the principles of accountability, transparency, and care for the Personal Information entrusted to VCC by College members and Community Members.

This policy informs all members of the VCC community of their rights and responsibilities under the Act and other applicable laws, and establishes VCC's operational and administrative requirements under the Act.

This policy applies to all Personal Information and Records in the custody or under the control of VCC, and to all VCC Board of Governors members and Employees, including Volunteers and Service Providers and their subcontractors.

1. VCC recognizes its legal and ethical responsibilities to protect Personal Information of its Employees, Students, Board members, and Community Members and to provide the public with access to College Records.


2. VCC is committed to meeting its obligations under the Act and to following the requirements of the Act, the guidance of the Office of the Information and Privacy Commissioner, and other applicable legislation and best practices.


3. VCC collects, uses, discloses, stores, and secures Personal Information about its Students, Board members, Employees, and Community Members in compliance with the Act, other applicable legislation, and in accordance with best practices and guidelines.


4. VCC will respond to requests for access to information or records openly, accurately and completely, in accordance with the Act.


5. The College's Privacy Management Program is developed in accordance with the directions of the minister responsible for the Act, and is regularly monitored and updated as required. 


6. The College will treat Personal Information in its custody and/or under its control with a high degree of confidentiality. The College will only use Personal Information it is authorized to collect for the purpose of supporting College operations or activities, and Personal Information will only be accessed by Employees for that purpose and only by the authorized individuals as needed to complete their duties.


7. VCC recognizes its requirement under the Act to evaluate the privacy implications of all new or revised initiatives within the College that involve the collection, use, disclosure, or storage of Personal Information by completing Privacy Impact Assessments.


8. The College will investigate all reports of any Privacy Incident, Privacy Breach, or any other suspected or confirmed unauthorized disclosure of Personal Information.


9. The College will make every reasonable effort to protect the Personal Information in its custody and under its control through physical and technical security measures that meet the requirements of the Act and follow best practices. VCC is committed to continuously assessing its security systems to ensure they are sufficient and compliant. 


10. The College will provide regular and adequate training opportunities to ensure Employees are aware of their responsibilities and obligations under the Act.


11. Employees are responsible for ensuring they are compliant with the Act, and for the physical and technical security of all Records and data that they collect and use under the Act.

Access

The ability or opportunity to view, study, or obtain copies of Personal Information or other Records.

Community Member

An individual other than an Employee, Volunteer, Student, or Board member whose Personal Information is collected or accessed by VCC when participating in VCC's programs or services, such as donors, prospective or past Students or Employees, visitors, and other members of the public.

Contact Information

Information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual.

Employee

An individual who is currently employed by VCC on a full-time, part-time, permanent, temporary, term, casual, or contract basis. The Act defines Employee as including a Volunteer and a Service Provider. Therefore, when “Employee” is used in this policy and its procedures, the term includes Volunteers and Service Providers.

Personal Information

Recorded information about an identifiable individual other than contact information.

Personal Information Bank

A collection of personal information that is organized by and capable of being retrieved using an individual's name, identifying number, or another personal identifier.

Privacy Breach

The theft or loss, or other unauthorized collection, use, or disclosure of Personal Information in the custody or under the control of VCC and/or its Service Providers.

Privacy Complaint

A report of concern or dissatisfaction from any individual about how the College handled or processed their Personal Information.

Privacy Impact Assessment

An assessment involving a step-by-step review process that is conducted by VCC to determine if a current or proposed enactment, system, project, program, or activity (initiative) at the College meets or will meet the protection of privacy requirements of the Act.

Privacy Incident

The potential mishandling of Personal Information, or a suspected but unconfirmed, Privacy Breach. A Privacy Incident may become a Privacy Breach after investigation.

Privacy Protection Schedule

A schedule that forms part of a contract with a Service Provider and details a Service Provider's requirements under the Act for the security, storage, collection, use, retention, disclosure of Personal Information.

Record

Anything on which information is recorded or stored by graphic, electronic, mechanical or other means, but does not include a computer program or any other mechanism that produces records. In this policy, a Record is any recorded or stored information that is in the custody or under the control of VCC and within the scope of the Act.

Routinely Available Information

Records that can be released to an individual without the requirement of a formal access to information/Freedom of Information request. These Records include: publicly available information; records that have been provided by or previously released to the requester; Personal Information about an individual released on the basis of consent from that individual, such as transcripts; and Records determined by VCC to be Routinely Available.

Service Provider

A person or vendor retained under contract to perform services for VCC. FIPPA applies to all employees and associates of a Service Provider.

Student

A person who is, or was, registered in full-time or part-time credit or non-credit courses offered by VCC.

Volunteer

An individual who works for VCC without being paid.

• Appropriate and Responsible Use of Educational and Information Technology (505)
• Archives (521)
• Cyber Security (506)
• Electronic Mail (Employees) (503)
• Internet of Things (504)
• Records Management (520)
• Sharing & Stewardship of Information (502)
• Standards of Employee Conduct & Conflict of Interest (202)

• College and Institute Act, RSBC 1996, c 52


• Human Rights Code, RSBC 1996, c 210


• Freedom of Information and Protection of Privacy Act, RSBC 1996, c 165