��ݮ����Ƶ����

With the repeal of FOIP, the Government of Alberta has separated access to information and privacy into two distinct frameworks: the (ATIA) and (POPA). These changes took effect on June 11, 2025. The new legislation, and applicable regulations, contain many of the same requirements as FOIP with some key changes and additions. 

ATIA aims to improve transparency while addressing concerns resulting from the administrative burden that may arise from requests for access to public records. Key changes include:

• Clarifying that electronic records are included in the scope of records that may be subject to public access to information requests.
• Extending time limits for responding to access to information requests.
• Adding discretionary exemptions allowing public bodies to disregard requests that would unreasonably interfere with operations, that are overly broad or incomprehensible, that have already been made public, or that are abusive, threatening, frivolous or vexatious.
• Adding exemptions for the disclosure of certain records, including records relating to workplace investigations or labour disputes.
• Increasing penalties for offences of up to $50,000.

POPA builds upon existing privacy requirements with a view to strengthen the rules that govern the protection of personal information held by public bodies. Key changes include: 

• Requiring each public body to develop and implement a comprehensive privacy management program, documenting their privacy policies, procedures and practices and promoting compliance with the legislation.
• Adding mandatory privacy breach reporting to affected individuals and to Alberta’s Office of the Information and Privacy Commissioner (OIPC).
• Adding mandatory privacy impact assessments (PIAs) when implementing any new, or a substantial change to an existing, administrative practice, program, project, or service that collects, uses or discloses personal information in certain prescribed circumstances.
• Expressly prohibiting the selling of personal information.
• Requiring public bodies to advise individuals at the time of collection if there is an intention to input their personal information into an automated system to generate content or make decisions, recommendations, or predictions, including an artificial intelligence, machine-learning, or deep-learning software or technology.
• Requiring the implementation of a data quality assurance process for the creation and management of “data derived from personal information” and “non-personal data,” including methods to track how personal information has been de-identified, tracked, managed, and secured.  
• Increasing penalties for privacy violations, including up to $200,000 for individuals and $1 million for organizations.

The Access and Privacy Office, reporting into ��ݮ����Ƶ���� Legal Services, is responsible for overseeing ��ݮ����Ƶ����’s compliance with Alberta’s access to information and privacy requirements (now governed by ATIA and POPA).

The Access and Privacy Office can provide compliance advice and guidance to ��ݮ����Ƶ���� administrators and the broader campus community on all matters related to access to information and protection of privacy and is responsible for managing and responding to access to information requests.

Yes. The Access and Privacy Office is currently collaborating on a project to roll out updated privacy awareness training and annual refresher training for all ��ݮ����Ƶ���� employees this fall.

This training will help staff understand their responsibilities under ATIA and POPA, and how to apply privacy best practices in their day-to-day work. 

Personal information includes any recorded information about an identifiable individual. This includes any information that may be used to identify an individual either alone or in combination with other available data. 

Personal information may include, but is not limited to an individual’s:

• Name and home or business contact information (unless provided in a business or professional capacity),
• Demographic information such as age, sex, gender, weight, height, date of birth, race, colour, ethnicity, place of origin, or citizenship status,
• Marital or family status and sexual orientation,
• Unique identifiers such as driver’s license, passport, SIN, or student number,
• Income or financial information, including payroll or payment card information,
• Political or religious beliefs or associations,
• Educational, employment or criminal history,
• Physical or mental health status and health care history,
• Biometric information, such as fingerprints, blood type or genetic information, and
• Personal views and opinions, including survey response data.

��ݮ����Ƶ���� may only collect personal information from individuals that is reasonably required for an operating program or activity of ��ݮ����Ƶ����, or where specifically permitted under an enactment of Alberta of Canada.

Individuals must be advised at the time of collection the purposes for which their personal information is being collected, the statutory authority for the collection, and how it may be used or disclosed by ��ݮ����Ƶ����. This can be achieved through a clear collection notice under section 5(2) of POPA, which should include:

• The title of the ��ݮ����Ƶ���� operating program or activity the collection relates to,
• The target group of your collection (e.g., specific students, faculty, staff, etc.),
• The purpose of your collection, including how personal information may be used internally or disclosed externally,
• The type of personal information that will be collected,
• The specific legal authority (statute) for your collection of personal information,
• How you intend to safeguard confidentiality, including details regarding how personal information will be secured and managed,
• Whether you intend to input the information into an automated system to generate content to make decision, recommendations, or predictions, such as an AI, machine-learning or deep-learning system or technology, and
• The name, title, business phone number and business address of a contact person who can answer questions about the collection.

Any personal information collected must be directly related to and necessary for achieving the identified purpose, and you should only collect the minimum amount of personal information reasonably required to achieve that purpose and not simply because it may be “nice to have”. For an example collection notice, please see the Guidelines for the Collection of Personal Information.

Yes. Your collection notice will need to be updated to reference POPA instead of FOIP and any reference to “section 33(c)” of FOIP should be replaced with “section 4(c)” of POPA. You should also review the language of your collection notice generally and make any required changes regarding how personal information will be collected, used, disclosed, or managed. 

Note that POPA now requires that you specifically advise individuals at the time of collection of any intention to input their personal information into an automated system to generate content to make decision, recommendations, or predictions, such as an AI, machine-learning or deep-learning system or technology. For an example collection notice, please see the Guidelines for the Collection of Personal Information.

Yes. Under POPA, personal information may only be used for the purpose for which it was originally collected or a use consistent with that purpose. Consistent use means that the use of the personal information is directly related to the original purpose and is a form of use that could have been reasonably expected by the individual at the time of collection.

If you or another faculty, department or business unit intend to use personal information for a secondary use that is not consistent with the original purpose of collection, then a new consent will be required unless the use is specifically permitted under POPA. The use should also be approved by the relevant data steward with institutional oversight over the information under the ��ݮ����Ƶ���� Information Asset Management Policy and should only be used in accordance with the privacy impact assessment (PIA), where applicable.

Yes. Under POPA, personal information may only be disclosed to a third party for the purpose for which it was originally collected or for a reason consistent with that purpose. This means that the disclosure of the personal information must be directly related to the original purpose of its collection and could have been reasonably expected by the individual at the time of collection.

��ݮ����Ƶ���� may also disclose personal information where specifically permitted under section 13 of POPA, including where it is not considered an unreasonable invasion of the individual's privacy. For example, it is generally not considered an unreasonable invasion of an individual's privacy to release the following information:

• Certain student enrolment or registration information as outlined in the ��ݮ����Ƶ���� Privacy Policy,
• Information required to be disclosed under a law of Alberta or Canada,
• Information about an employee's job classification, salary range, discretionary benefits or employment responsibilities,
• Information that reveals business contact information or details regarding the supply of goods or services to ��ݮ����Ƶ����,
• Information about a scholarship, honour or award granted by ��ݮ����Ƶ���� to a third party, or
• Information about an individual who has been deceased for 25 years or more.

If you or another faculty, department or business unit intend to disclose personal information for a secondary purpose that is not consistent with the original purpose of collection, then a new consent will be required unless the disclosure is specifically permitted under POPA. The disclosure should also be approved by the relevant data steward with institutional oversight over the information under the ��ݮ����Ƶ���� Information Asset Management Policy and should only be disclosed in accordance with the privacy impact assessment (PIA), where applicable.

��ݮ����Ƶ���� may be required to conduct a privacy impact assessment (PIA) under section 26 of POPA. This includes where ��ݮ����Ƶ���� intends to implement any new, or make a substantial change to any existing, administrative practice, program, project or service that collects, uses or discloses personal information where the loss, unauthorized access to or unauthorized disclosure of that information could result in a real risk of significant harm to an individual. A PIA will also be required in all circumstances outlined in the Protection of Privacy (Ministerial) Regulation, Alta Reg 143/2025.

A PIA must identify the risks associated with ��ݮ����Ƶ����'s collection, use and disclosure of personal information and must:

• Include a summary of the purpose of the collection, use or disclosure of personal information for the proposed practice, program, project or service,
• Identify the types of personal information that will be collected, used or disclosed and reasonable security arrangements in place to protect the information,
• Identify the legal authority for the collection, use or disclosure of the information,
• Identify the privacy risks and mitigation strategies respecting the information,
• Identify any administrative, physical or technical safeguards in place to protect the personal information, including how the personal information will be securely transmitted, matched or linked, if applicable,
• Describe accuracy, correction and retention procedures that will be implemented to ensure the personal information is accurate and complete, and
• Establish a clear governance structure respecting the responsibilities and accountability of ��ݮ����Ƶ����, and any other public body participating in the program.

The creation of a PIA can result in a significant amount of work. If you intend to introduce a new program or service involving the collection of personal information, or make substantial changes to an existing one, it is recommended that you contact the Access and Privacy Office early to determine whether a PIA is required or recommended. For more information, please see the Guidelines for the Collection of Personal Information.

Yes. POPA now requires ��ݮ����Ƶ���� to implement a data quality assurance process regarding the creation, use and disclosure of data derived from personal information and non-personal data.

• Data derived from personal information means identifiable data created through data matching using personal information already in the custody or under the control of ��ݮ����Ƶ����.
• Non-personal data means data created from personal information that has been generated, modified, de-identified or anonymized so that it does not identify any specific individual.

��ݮ����Ƶ���� may only create data derived from personal information or non-personal data for the purposes of research or analysis, or where it is directly relating to the planning or delivery of an operating program or service. ��ݮ����Ƶ���� must also verify that any personal information that has been de-identified or anonymized cannot be re-identified and maintain a record in each case containing: 

• A description of the personal information used,
• The purpose of creating the non-personal data,
• The methods of de-identification used, and
• an assessment of their effectiveness.

POPA also maintains restrictions on the use and disclosure of data derived from personal information and non-personal data. ��ݮ����Ƶ���� is prohibited from disclosing data derived from personal information except in extremely limited circumstances. Non-personal data may only be disclosed subject to an information sharing agreement, unless it is being disclosed strictly in aggregate or statistical form as part of a report, summary or other publication. For more information, please see the Guidelines for the Collection of Personal Information.

If you suspect that a privacy incident has occurred involving the loss of, unauthorized access to or unauthorized disclosure of personal information, you should report it immediately to the Access and Privacy Office by completing the Privacy Breach Incident Report form and sending it to accessandprivacy@ucalgary.ca.

It is important that you do not delay and report the incident as soon as possible. You may take steps to immediately attempt to contain or mitigate the breach, but do not attempt to notify individuals or fully resolve the incident on your own; the Access and Privacy Office will determine whether a privacy breach has occurred and will guide the response process. 

Under POPA, ��ݮ����Ƶ���� may also be required to report the privacy breach without unreasonable delay to the affected individuals, the Office of the Information and Privacy Commissioner of Alberta (OIPC), or the Minister, where there has exists a real risk of significant harm to an individual as a result of the incident.

Yes, but only with appropriate safeguards. POPA permits the electronic storage and management of personal information (whether inside or outside of Canada) but requires ��ݮ����Ƶ���� to make reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, or destruction of personal information. For this reason, you must not store personal or confidential information on devices or software platforms that have not been approved by ��ݮ����Ƶ����.  

If you wish to acquire a software/application or retain the services of a data management or storage provider (located inside or outside of Canada) that will store, process or manage personal or confidential information, you must submit a request through the ��ݮ����Ƶ���� . Please refer to ��ݮ����Ƶ���� Legal Services Guidelines for the Software Acquisition Process for more information and recommended best practices.  This enables ��ݮ����Ƶ���� to ensure compliance with POPA’s privacy protection requirements. Note that you may be required to conduct a privacy impact assessment (PIA) under section 26 of POPA. You will also be required to enter into an appropriate service agreement with the individual or entity managing or storing the data to specify the conditions under which data will be secured and what happens in the event of a privacy incident/breach.

Yes, but only with consent and appropriate safeguards. Under section 5(2) of POPA, ��ݮ����Ƶ���� is required to advise individuals at the time of collection if there is any intention to input their personal information into an automated system to generate content to make a decision, recommendations, or predictions, such as an artificial intelligence, machine-learning or deep-learning system or technology (AI). ��ݮ����Ƶ���� is also required to make reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, or destruction of personal information.

If you intend to use AI, please follow ��ݮ����Ƶ����’s institutional policies and ethical guidelines around the use of AI:

• Use AI ethically and in accordance with applicable laws and ��ݮ����Ƶ����’s Information Asset Management Policy, Acceptable Use of Electronic Resources and Information Policy, Research Integrity Policy, Student Academic Misconduct Policy and Student Non-Academic Misconduct Policy.
• Use only the ��ݮ����Ƶ���� approved secure version of as it offers better security, privacy, and protection of data, and complies with ��ݮ����Ƶ����’s policies and standards. If you intend to use or acquire another AI platform, please follow the Supply Chain Management .
• Be cautious when using Level 3 or 4 confidential or personal information with an AI tool and ensure that you are familiar with the privacy best practices in the Legal Services Guidelines for the Software Acquisition Process.
• Obtain consent directly from individuals prior to inputting or disclosing their personal information into an AI tool. For questions, please contact accessandprivacy@ucalgary.ca.
• Ensure that the rights of creators are respected and that you have the appropriate written permission to input or disclose materials protected by copyright or other intellectual property rights into an AI tool. For questions, please contact copyright@ucalgary.ca.
• Do not use an AI tool to make decisions that will have a serious impact on the rights of an individual, or that could have serious consequences for an individual’s life, education, career, dignity, or autonomy.
• Be transparent and make sure to disclose when you use AI to generate information, reports, summaries, images, etc.

Failure to comply with ATIA or POPA can result in serious consequences for ��ݮ����Ƶ���� and its many stakeholders, including:

• Lengthy and costly disputes or regulatory proceedings that may result in an adverse order from a court or the Office of the Information and Privacy Commissioner of Alberta (OIPC) compelling compliance with the legislation, including ordering the release of certain records or changes to ��ݮ����Ƶ����'s privacy practices.
• Reputational damage, including increased public scrutiny, media attention, and a loss of trust from students, staff, partners, donors, funding agencies and the broader community.
• Financial penalties, including fines of up to $50,000 for an offence under Section 95 of ATIA and up to $200,000 for individuals and $1 million for organizations for an offence under section 60 of POPA.

The Access and Privacy Office plays a key role in ensuring that ��ݮ����Ƶ����’s policies and practices align with ATIA and POPA requirements, including providing guidance, training, and advice. Please work with the Access and Privacy Office to ensure ��ݮ����Ƶ����'s compliance with its obligations under ATIA and POPA.

No. All access to information requests should be directed to the Access and Privacy Office so that they can be reviewed and responded to in accordance with ATIA and ��ݮ����Ƶ����’s Delegation of Authority Policy. 

You may be contacted by the Access and Privacy Office to assist in locating records or clarifying an access to information request. If you are contacted, please respond promptly, as ��ݮ����Ƶ���� is bound by strict statutory deadlines contained in the ATIA. Do not alter, redact, or delete records. All records must be preserved and provided for review in their original form. Please note that not all records provided to the Access and Privacy Office will be disclosed. Instead, they will be reviewed and withheld or redacted where appropriate and permitted under ATIA.

If you receive a request directly from an individual (e.g., a student or external party), please forward it immediately to the Access and Privacy Office at .

No. ATIA is intended to complement - not replace - existing procedures for accessing information or records at ��ݮ����Ƶ����. It should be used as a last resort when information is not otherwise available through routine channels. You are encouraged to first explore existing ��ݮ����Ƶ���� procedures or contact the relevant faculty, department, or business unit directly.

If the information you seek is not available through the ��ݮ����Ƶ���� website or existing ��ݮ����Ƶ���� procedures, you may submit a formal access to information request under the ATIA. To be valid, your request must meet the following criteria under section 7(2) of ATIA and must:

1. Be in writing – This can be submitted via email, physical mail, online form, or in person.
2. Be submitted to the appropriate public body – in this case, ��ݮ����Ƶ����. Note that we are unable to respond to requests for records in the custody or under the control of third parties.
3. Provide sufficient detail – Enough information must be included to allow ��ݮ����Ƶ���� to locate the records with reasonable effort.
4. Include the required fee – A $25 fee applies for general (non-personal) access to information requests.

Requests that do not meet these criteria will not be processed. If clarification is needed, the Access and Privacy Office will contact you, and you will have 30 business days to respond. Failure to do so may result in the request being considered abandoned.

Formal requests should be submitted using the Request to Access Information form and be directed to the Access and Privacy Office at accessandprivacy@ucalgary.ca. 

ATIA applies to all existing records - including electronic records - in the custody or control of ��ݮ����Ƶ���� unless specifically excluded under section 4 of the ATIA or subject to an exemption to disclosure under Part 1, Division 2.

This may include access to records in any form in which information is contained or stored, including information in any written, graphic, electronic, digital, photographic, audio or other medium, but does not include any software or other mechanism used to store or produce the record. Examples include emails, PDFs, physical records, text messages, Teams chat messages, spreadsheets, audio, or video files, system generated reports, etc. 

If you receive a request for assistance with an access request by the Access and Privacy Office, it is important that you ensure all relevant records are located and provided in their original format. If you are unsure whether something qualifies as an electronic record, or how to retrieve it, contact the Access and Privacy Office at accessandprivacy@ucalgary.ca. 

��ݮ����Ƶ���� is required under section 12 of ATIA to make reasonable efforts to assist applicants and to respond to each applicant openly, accurately, and completely, and in accordance with ATIA and regulations. 

This means that access to information requests should be handled quickly, efficiently and in a professional manner, and clear reasons should be provided when access to records is denied. Note that unless the applicant has requested the personal information of another person, the identity of the applicant and indeed the motive for the request are not relevant. If information can be disclosed, it must be disclosed regardless of who has asked the question or why they want the information.

Yes, in some circumstances. Under ATIA, a public body is required to provide access to existing records - including electronic records - or create a record if the record can be created using the public body’s normal computer hardware, software, and technical expertise, and if doing so would not unreasonably interfere with the operations of the public body, and otherwise would be reasonable and practical.

This obligation is part of the public body’s “duty to assist” applicants under section 12 of ATIA. This means that if the requested information exists in a database or other electronic system, and a readable record (e.g., a report or export) can be generated without significant disruption, ��ݮ����Ƶ���� must do so.

If you are requesting access to general (non-personal) information, you are required to pay an initial fee of $25.00 for one-time requests and an initial fee of $50.00 for continuing requests. The initial fee must be paid before ��ݮ����Ƶ���� will begin processing the request.  

If you are requesting access to your own personal information, you are not required to pay an initial fee under ATIA. 

Under section 96 of ATIA and sections 13 and 14 of the Access to Information Act Regulation, Alta Reg 133/2025, fees may also be charged in accordance with Schedule I. For general information, fees may be charged for various services carried out by ��ݮ����Ƶ���� in responding to your request (including searching for, producing, formatting, preparing and handling records) if the amount of fees exceeds $150.00. A fee may not be charged for the time spent in reviewing a record. If the estimated cost exceeds $150.00, ��ݮ����Ƶ���� will provide a fee estimate before proceeding. You may then choose to proceed, modify your request, or withdraw it. 

For personal information, fees may be charged only for producing a copy of the records in accordance with items 3 to 6 of Schedule I (including photocopying, scanning, printing or providing records in another form of physical media), and only if the total cost exceeds $10.00. These fees are limited to the actual cost of reproduction. If the estimated cost exceeds $10.00, ��ݮ����Ƶ���� will provide a fee estimate before proceeding. You may then choose to proceed, modify your request, or withdraw it. 

These fee requirements ensures that access to information remains affordable while allowing public bodies to recover reasonable costs associated with fulfilling the request. 

Under Section 96(5) of ATIA, the head of a public body has the discretion to excuse an applicant from paying all or part of a fee if:

• The applicant cannot afford to pay,
• It is otherwise fair to excuse payment, or
• The record relates to a matter of public interest, including the environment or public health or safety.

To assess a request for a fee waiver, ��ݮ����Ƶ���� may ask the applicant to provide supporting information. This may include:

• The need for the information,
• Whether there are alternative sources for the information, and
• And the reasons for the inability to pay.

Additionally, the Access and Privacy Office may assist applicants in narrowing the scope of their request to reduce or eliminate fees.

Under Section 35 of ATIA, ��ݮ����Ƶ���� must notify a third party if it is considering granting access to a record that contains:

• Personal information of a third party the disclosure of which may be an unreasonable invasion of the third party’s privacy, or
• Business or commercial information the disclosure of which may be harmful to the third party’s interests.

This notification is required before the record is disclosed, giving the third party an opportunity to consent to the disclosure, or provide written reasons why the information should not be disclosed. The third party has 20 business days from the date of notification to respond.

If the third-party objects to disclosure, ��ݮ����Ƶ���� must consider their response before making a final decision. If access is granted despite the objection, the third party may request a review by the Office of the Information and Privacy Commissioner of Alberta (OIPC) under Part 3 of the Act. 

If ��ݮ����Ƶ���� decides not to disclose the third party’s information, notification is not required. However, it may still be provided as a courtesy, unless doing so would be unduly burdensome.

No. Under Section 13 of POPA, ��ݮ����Ƶ���� must not disclose personal information about an applicant unless it is necessary for an employee to know that information to process or respond to the request.

This means that the name of an individual applicant should not be shared in internal reports or listings unless the recipient has a direct role in managing or responding to that specific request.

If the applicant is a business or organization, their name may be disclosed, as privacy protections under the Act apply only to individuals. However, even in such cases, routine circulation of requester names is not recommended.

Instead, internal summaries may include:

• A description of the request (e.g., topic or subject matter),
• The type of applicant (e.g., individual, media, business), or
• And any relevant status updates.

This approach supports transparency and coordination while respecting the privacy rights of individuals under POPA.

Under Section 95(1) of ATIA, it is an offense for any individual to knowingly destroy, alter, falsify, or conceal a record with the intent to evade an access to information request.

If found guilty of an offence under ATIA, an individual may be personally liable for a fine of up to $50,000.

This provision reinforces the importance of transparency and accountability in the handling of records. All ��ݮ����Ƶ���� employees are expected to preserve records that may be relevant to an access request and to cooperate with ��ݮ����Ƶ����'s Access and Privacy Office.

Under POPA, ��ݮ����Ƶ���� may only collect personal information from students that is reasonably required for an operating program or activity of ��ݮ����Ƶ����, or where specifically permitted under an enactment of Alberta of Canada.

Students must be advised at the time of collection the purposes for which their personal information is being collected and how it may be used or disclosed by ��ݮ����Ƶ����. Any personal information collected must be directly related to and necessary for achieving the identified purpose, and you should only collect the minimum amount of personal information reasonably required to achieve that purpose and not simply because it may be “nice to have."

For more information, please see the Legal Services Guidelines for the Collection of Personal Information or contact the Access and Privacy Office at accessandprivacy@ucalgary.ca. 

No. Under POPA, personal information such as an individual’s SIN may only be collected if it is directly authorized by law or necessary for an operating program or activity of ��ݮ����Ƶ����.

An individual’s SIN is a federally regulated identifier and should only be collected by ��ݮ����Ƶ���� when:

• Required for reporting income to the federal government (e.g., for employment or scholarship purposes), or
• Explicitly authorized by legislation.

Using a SIN for general identification or proof of citizenship is not permitted under POPA and may constitute an over-collection of personal information.

Only under specific conditions. Under Section 5(1) of POPA, ��ݮ����Ƶ���� may collect personal information about a third party indirectly if it is necessary to:

• Collect emergency contact information,
• Determine suitability for an honour or award, including an honorary degree, scholarship, prize, or bursary, or
• Determine or verify a student’s eligibility for a benefit, service, or program.

If one of the conditions under section 5(1) is not met, ��ݮ����Ƶ���� must collect the information directly from the third party or obtain written authorization from the third party to collect it from the student.

No. Under sections 12 and 13 of POPA, access to personal information must be limited to what is necessary for an employee to perform their duties. The fact that a staff member can technically access student information does not mean they are authorized to do so. 

Access to student personal information must be:

• Role-based and purpose-specific,
• Governed by ��ݮ����Ƶ����’s privacy management program (as required under section 25 of POPA), and
• Logged and monitored where appropriate to ensure compliance.

Unauthorized access to student information may constitute a privacy breach and could result in disciplinary action or penalties under POPA.

Yes, with restrictions. The ��ݮ����Ƶ���� Privacy Policy states that it is not considered an unreasonable invasion of a student’s privacy to release the following information:

• Dates of registration at ��ݮ����Ƶ����,
• Faculty/department or program of registration at ��ݮ����Ƶ����,
• Degree(s)/diploma(s) awarded by ��ݮ����Ƶ����,
• Convocation dates,
• Attendance at or participation in a public event or activity related to ��ݮ����Ƶ���� (e.g. graduation, sporting or cultural event, etc.), or
• Personal information already in the public domain.

Other student personal information should be kept confidential and disclosed only with consent or as otherwise permitted under POPA.

No. A student’s hometown or home address is considered personal information under POPA for which disclosure may amount to an unreasonable invasion of privacy. Therefore, this information should not be disclosed without written consent or where otherwise permitted under POPA.

No, not without consent. A timetable contains personal and academic information and is protected under POPA. Therefore, this information should not be disclosed without written consent or where otherwise permitted under POPA.

Yes. Under Section 13(1)(j) of POPA, personal information may be disclosed for the purpose of collecting a debt owed to ��ݮ����Ƶ����. A notation of the disclosure should be recorded in the student’s account file.

Only the minimum necessary personal information should be disclosed, such as the student’s name, home and business contact information, amounts owing and reason for the debt. This aligns with privacy best practises and the principle of data minimization.

Yes, but with limits. Students are advised at the time of admission that some personal infromation may be disclosed to student clubs, societies, and associations, including the Students’ Union, for the purpose of administering or facilitating their operations or provision of services to students on campus. 

Such personal information will only be disclosed where reasonably required for the student club, society, or association to provide its program or services, and will be subject to an appropriate information sharing agreement. 

No, not without consent. A student’s application status constitutes personal and academic information and is protected under POPA. Therefore, this information should not be disclosed without written consent or where otherwise permitted under POPA.

Yes, but with limits. ��ݮ����Ƶ���� may withhold official documents (e.g., transcripts, diplomas) due to outstanding fees. However, under section 6 of ATIA, students have a right to access their personal information, including academic records. Therefore, ��ݮ����Ƶ���� must still provide a statement of grades or other personal information upon request, even if the student owes money, but is not required to provide an official document.

Yes, with exceptions. Under section 6 of ATIA, students have a right to access their own personal information, including documents they submitted. However, ��ݮ����Ƶ���� may withhold or redact portions of records subject to potential exemptions or exceptions from disclosure under ATIA.

Yes, with conditions. ��ݮ����Ƶ���� is required to provide one copy of a record in response to a personal information request. Under section 9 of ATIA, ��ݮ����Ƶ���� may disregard an access to information request that is repetitive or abusive requests. ��ݮ����Ƶ���� may also charge a reasonable fee for additional copies, as permitted under section 3(a) of ATIA.

Yes. Under ATIA, general information about the performance of a public institution such as ��ݮ����Ƶ���� is not considered personal information if it does not identify specific individuals or fall within another exemption or exception from disclosure under ATIA.

Not without consent. Under POPA, students aged 16 or older are considered capable of making decisions about their personal information. Disclosure to parents requires the student’s written consent, regardless of age.

Yes, with exceptions. Under POPA, personal information includes recorded opinions or evaluations about an identifiable individual. Therefore, notes taken during an interview process that relate to a specific individual are considered personal information and are generally accessible under section 6 of ATIA, although may still be subject to exceptions from disclosure under ATIA. Evaluators should ensure notes are factual, professional, and defensible, as they may be subject to access requests.

Yes, with conditions. Under POPA, a faculty or staff member may collect personal information from a student if:

• The information is necessary for an academic or administrative purpose related to ��ݮ����Ƶ����’s operations, and
• The purpose is clearly communicated to the student at the time of collection.

This aligns with POPA’s requirement that personal information must be collected only when directly related to and necessary for an operating program or activity. Please note that sensitive personal information must be protected against unauthorized access, use, disclosure, or destruction.

For more information, please see the Legal Services Guidelines for the Collection of Personal Information or contact the Access and Privacy Office at accessandprivacy@ucalgary.ca. 

Only on a strict need-to-know basis, and only for a purpose connected to their role as a faculty member. Under Section 12 of POPA, personal information may only be used by an employee of ��ݮ����Ƶ���� if the information is necessary for an operating program or activity of ��ݮ����Ƶ���� and for the performance of their duties.

The faculty member must demonstrate that access to the student’s contact information is reasonably necessary for a legitimate academic or administrative function. ��ݮ����Ƶ���� must document and limit such uses to what is strictly required.

Only with the student’s consent. Under Section 13 of POPA, personal information may only be disclosed with the individual’s consent or if authorized by law.

Acceptable forms of consent include:

• A signed reference request form,
• A statement in a job application authorizing contact with ��ݮ����Ƶ���� or a specific individual, or
• An email or written request from the student.

Please use the Access and Privacy Office template Reference Consent Forms and retain a signed copy of the consent. Faculty members are encouraged to only disclose factual or opinion-based information that they are qualified to provide.

No. Even if a faculty member has previously agreed to provide a reference, written consent is still required under POPA before disclosing any personal information.

Acceptable forms of consent include:

• A signed reference request form,
• A statement in a job application authorizing contact with ��ݮ����Ƶ���� or a specific individual, or
• An email or written request from the student.

This ensures compliance with POPA’s consent and disclosure requirements and protects the student’s privacy. 

Possibly, but with some exceptions. Under section 6 of ATIA, students have the right to access personal information about themselves. 

However, if a letter of reference was provided in confidence, ��ݮ����Ƶ���� may withhold or redact portions of the letter under section 17 or 22 of ATIA to protect the privacy of the referee, especially if disclosure would reveal the identity or opinions of the referee. The Access and Privacy Office will consult with the referee in each case prior to disclosure.

Possibly, but with some exceptions. Evaluative opinions about a student are considered their personal information under ATIA and POPA and are generally accessible. However, ��ݮ����Ƶ���� may:

• Withhold the substance of committee deliberations under section 29 of ATIA if disclosure would reveal internal decision-making processes, or
• Redact letters of recommendation or identifying details under section 19, 20 or 22 of ATIA if they would reveal identifying details about third parties or where they were provided in confidence.

The student should still receive a summary of the reasons for the decision, ensuring transparency while protecting third party privacy.

There is no specific rule, but best practices apply. POPA does not specify a fixed duration for consent validity. However, consent should be:

• Time-limited where possible (e.g., stated on the form),
• Relevant to the purpose for which it was given, and
• Recent enough to reflect the individual’s current expectations.

If no expiry is stated, consider the context and timing. For example, consent given for a job application is likely valid only for that specific process. Consent from years ago for a different purpose is unlikely to still apply.

No, not in a way that identifies specific individuals. Under POPA, public disclosure of grades using identifiable information, such as names or student ID numbers, is not permitted.

Even though student ID numbers may seem anonymous, their widespread internal use in association with specific individuals can lead to individuals being identifiable. Therefore, grades should not be posted in any public or semi-public format that could reasonably identify a student.

If grades must be shared, they should be provided individually and privately (e.g., through a secure learning management platform), or de-identified and posted in a way that no individuals can be re-identified.

Yes, in most cases. POPA does not prohibit peer marking when it is part of a pedagogically sound classroom activity. If the activity is supervised and does not result in the public disclosure of personal information, it is not considered an unreasonable invasion of privacy and students should reasonably expect that their name or student number may be disclosed to other students within the context of classroom activities. 

However, note that students may be increasingly sensitive and concerned about their privacy in the classroom. Peer marking may also raise other concerns relating to the student’s ownership of any intellectual property rights in their course work. Especially in the graduate student context, or where the work is sufficiently original and the produce of the student’s own skill, judgment and intellectual effort.

Yes. Instructors may share class averages or anonymous grade distributions. However, individual student marks must not be disclosed in a way that identifies other students. This supports transparency in academic performance while protecting privacy.

Yes. POPA does not restrict students from voluntarily sharing their own work in a classroom setting. Reading essays aloud is a common academic practice and does not constitute a privacy violation when done voluntarily.

Under POPA, personal information must be protected and retained only as long as necessary for the purpose for which it was collected. While POPA does not specify exact timelines, ��ݮ����Ƶ����’s internal retention schedule (e.g., ) recommends that unclaimed student work be retained for a reasonable period, typically six months after the end of term. Instructors should:

• Securely store unclaimed work,
• Inform students of the retention period, and
• Ensure secure disposal after the retention period ends.

This aligns with POPA’s requirement for the secure handling of personal information.

Yes. Under section 6 of POPA and ��ݮ����Ƶ���� policy, any record used to make a decision about an individual must be retained for at least one year. This includes any email that:

• Documents a decision (e.g., grade appeal, academic accommodation), and
• Is not duplicated elsewhere in a formal record.

If the email is transitory (e.g., scheduling, informal discussion, etc.) and not used in decision-making, it may be deleted once no longer needed. This is consistent with and POPA’s principles of data minimization and secure disposal.

Yes. Under section 6(1) of ATIA, students have the right to access personal information about themselves held by a public body, including files maintained by a supervisor, unless a specific exception applies.

Under section 6 of POPA, ��ݮ����Ƶ���� is required to keep all records used to make a decision about an individual for a minimum of one year. 

However, transitory documents and documents that are duplicated in the official student file should be destroyed regularly. This is consistent with .

No. Any questions to be used on an examination or test are specifically excluded from public access under section 4 of ATIA. ��ݮ����Ƶ���� may also refuse to disclose testing or audit procedures or techniques or standardized tests if disclosure could reasonably be expected to prejudice the use or results of a particular test or audit under section 31 of ATIA.

Yes. Under section 6 of ATIA, students have the right to access personal information about themselves held by a public body. Completed examination papers, including the student’s answers, are considered personal information and part of their educational record.

If the exam questions are intended for future use, ��ݮ����Ƶ���� may sever those questions before releasing the record, as permitted under section 4 or 31 of ATIA, which allows withholding of test questions to protect academic integrity.

Under section 25 of POPA, public bodies must implement reasonable security arrangements to protect personal information against such risks as unauthorized access, use, or disclosure. As a result, the practice of leaving graded examinations and assignments in a public place for pick up is not acceptable. Examinations and assignments should be returned directly to the student, for example during class or office hours. Students should not be allowed to handle exams or assignments other than their own.

Instead:

• Return work directly to the student (e.g., in class or during office hours),
• Use sealed envelopes or secure digital platforms,
• Ensure students only access their own work.

Teaching and research assistants are considered employees under POPA and may access personal information only as necessary to perform their assigned duties.

No. The one-year retention requirement under POPA is intended to allow students to access and review the records used to make decisions about them, not to extend ��ݮ����Ƶ����’s appeal timelines.

Appeal deadlines are governed by ��ݮ����Ƶ���� academic policy, not by POPA or ATIA. Students must follow ��ݮ����Ƶ����’s formal appeal procedures, which may have shorter timelines.

Yes. Under POPA, anecdotal notes, observations, and evaluative comments made by faculty members about a student are considered the student’s personal information. As such, students generally have the right to access this information under section 6 of ATIA.

However, access may be limited in specific cases for various reasons permitted under ATIA. In complex cases, ��ݮ����Ƶ����’s Access and Privacy Office should be consulted to assess whether any exemption or exception from disclosure apply before releasing the records.

Under POPA, ��ݮ����Ƶ���� may only collect personal information from applicants and employees that is reasonably required for an operating program or activity of ��ݮ����Ƶ����, or where specifically permitted under an enactment of Alberta of Canada.

Applicants and employees should be advised at the time of collection the purposes for which their personal information is being collected and how it may be used or disclosed by ��ݮ����Ƶ����. Any personal information collected must be directly related to and necessary for achieving the identified purpose, and you should only collect the minimum amount of personal information reasonably required to achieve that purpose and not simply because it may be “nice to have”. 

Yes. Under Section 6 of the ATIA, individuals have the right to access personal information about themselves held by a public body. A job application submitted to People and Culture is considered personal information and is used to make decisions about the applicant, subject to potential exemptions or exceptions from disclosure under ATIA.

An applicant’s personal information may also include recorded opinions or evaluations about them, including notes taken during an evaluation process, subject to potential exemptions or exceptions from disclosure under ATIA. Evaluators should ensure notes are factual, professional, and defensible, as they may be subject to access requests, legal dispute or human rights proceeding. 

Under section 6 of POPA, any personal information used to make a decision about an individual must also be retained for at least one year to allow the individual to access it and request corrections if necessary.

Yes, with limitations. Disclosure of the business address, email or telephone number of a staff member is not considered an unreasonable invasion of privacy under section 20 of ATIA. 

��ݮ����Ƶ���� may also be permitted to disclose other employment information, such as job postings, job profiles or descriptions, employee classifications, compensation schemes or benefits programs. Timetables may be disclosed if they relate to an individual’s employment responsibilities, but caution should be exercised. If there is any risk to the employee’s health or safety, disclosure may be restricted under section 20 of ATIA.

However, personal contact information of employees (e.g., home address, personal email or phone number) and other personal information such as job applications, resumes, CVs, reference information, records of participation in an application or interview process and any recorded results of screening criteria, assessments or examination responses may be highly sensitive and is protected under POPA. Such information must be kept confidential and stored in a secure environment, and may only be disclosed with consent or otherwise in accordance with POPA.

Yes. Under section 20 of ATIA, it is not considered an unreasonable invasion of privacy to disclose employment status or position title of a ��ݮ����Ƶ���� employee. This type of information is generally considered part of an individual’s employment responsibilities and may be disclosed without consent.

Partially. Under Section 20(2)(d) of ATIA, it is not considered an unreasonable invasion of privacy to disclose an employee’s:

• Position classification,
• Salary range,
• Discretionary benefits, or
• Employment responsibilities.

However, the exact salary of an individual employee is considered personal information and may only be disclosed with consent or otherwise in accordance with POPA.

Yes. Under Section 13(1)(e) of POPA, personal information may be disclosed to comply with an enactment of Alberta or Canada. To comply with the Public Sector Compensation Transparency Act, ��ݮ����Ƶ���� is required to disclose names, positions, compensation, non-monetary benefits and severance of all employees whose total compensation, plus severance, exceeds a specified annual threshold.

Yes, with limitations. Under Section 13 of POPA, personal information may be disclosed:

• To comply with another enactment of Alberta or Canada, or
• For law enforcement purposes, including investigations into tax evasion.

Please refer all requests for personal information from external third parties to the Access and Privacy Office at accessandprivacy@ucalgary.ca. The requesting official must provide proof of identity, and the specific legal authority under which the information is being requested.

It depends on the content and purpose of the records. Under ATIA, records are accessible if they are in the custody or under the control of a public body and relate to its operational functions.

If the records are strictly personal and unrelated to ��ݮ����Ƶ���� business, they are not subject to TIA. If the records are used in decision-making, program delivery, or administrative functions, they are considered ��ݮ����Ƶ���� records and may be subject to access under section 6 of ATIA.

Faculty and staff should be aware that any records created or stored in the course of their duties may be subject to access requests.

Possibly, but with some exceptions. Evaluative opinions about an employee are considered their personal information under ATIA and POPA and are generally accessible. However, ��ݮ����Ƶ���� may:

• Withhold the substance of internal deliberations under section 29 of ATIA if disclosure would reveal internal decision-making processes, or
• Redact reviews or identifying details under section 19, 20 or 22 of ATIA if they would reveal identifying details about third parties or where they were provided in confidence.

Yes, with limitations. A student’s evaluation of a professor is considered the professor’s personal information under ATIA. Section 13(3) of POPA also permits ��ݮ����Ƶ���� to publicly disclosure student course evaluations for the purpose of assisting students in selecting courses. 

However, depending on the nature of the evaluation and how it was provided, ��ݮ����Ƶ���� may withhold or redact the information under ATIA. If the student’s identity can be protected (e.g., by redacting names or identifiers), the substance of the evaluation may still be released.

It depends on the content of the records and stage of the investigation. Records generally cannot be accessed during an active investigation. Under Section 24 of ATIA, access may be refused if disclosure would interfere with, prejudice or otherwise harm a workplace investigation, or cause harm to a witness or third party, or prevent a witness from coming forward as a witness. 

Records relating to an ongoing or completed investigation may also be withheld or redacted where disclosure would:

• Be harmful to the personal privacy or business interests of a third party,
• Be harmful to an individual’s or the public’s safety,
• Be harmful to a law enforcement matter or law enforcement generally,
• Reveal the identify of a complainant who has made a confidential complaint or disclosure under whistleblower protection legislation,
• Reveal confidential advice or recommendations to an internal decision maker, or
• Reveal information subject to legal privilege, including solicitor-client privilege or litigation privilege.

If you are a respondent to a workplace investigation, you may also obtain access to records as part of the investigation through internal processes and procedures that fall outside the scope of ATIA.

Yes, under specific conditions. Under section 5(1) of POPA, ��ݮ����Ƶ���� is permitted to collect personal information about individuals indirectly:

• For the purpose of law enforcement,
• For the purpose of managing or administering personnel, or
• Where direct collection would result in inaccurate or incomplete information.

These provisions allow internal investigations to proceed without notifying the subject in advance, provided the collection is necessary and proportionate.

Yes, in limited circumstances. While employees have a general right to access their own personal information under section 6 of the ATIA, ��ݮ����Ƶ���� may withhold information under section 30 if disclosure could reasonably be expected to:

• Harm ��ݮ����Ƶ����’s economic interests,
• Result in financial loss, or
• Interfere with negotiations related to a legal or insurance matter.

��ݮ����Ƶ���� must be able to demonstrate the likelihood of harm to justify withholding the information. 

No. Under section 3 of ATIA, no legal proceedings may be brought against ��ݮ����Ƶ���� or its employees for the good faith disclosure of information under the ATIA. 

An agreement not to publicly discuss a severance arrangement cannot override statutory obligations. If a record is subject to disclosure under the ATIA, ��ݮ����Ƶ���� must comply, and doing so in good faith protects it from liability.

Under section 6 of POPA, any personal information used to make a decision about an individual, such as whether to hire or not hire, must be retained for at least one year to allow the individual to access the record and request corrections.

Unsuccessful applications must be retained for one year if they were considered in the hiring process. Unsolicited applications that were not used in any decision-making process may be destroyed earlier as transitory records, typically within six months, in accordance with internal records retention policies.

Potentially, yes. Under section 6 of ATIA, individuals have a right to access their own personal information, including opinions about them. However, access may be restricted under the following discretionary exceptions if disclosure would:

• Be harmful to the personal privacy or business interests of a third party,
• Be harmful to an individual’s or the public’s safety,
• Reveal plans for managing personnel or administration that have not yet been implemented,
• Reveal a confidential evaluation compiled solely to determine suitability for employment or promotion,
• Reveal confidential advice or recommendations to an internal decision maker, or
• Reveal information subject to legal privilege, including solicitor-client privilege or litigation privilege. 

Each case must be assessed individually by the Access and Privacy Office to determine whether withholding or redacting a record is justified.

Yes, under specific conditions. Under section 13 of POPA, disclosure to a labour union may be justified to comply with a collective agreement, or where a bargaining agent has been authorized by the employee to make an inquiry on their behalf. Disclosure to a labour union may also be consistent with the purpose for which the information was originally collected from the employee.

The terms and conditions of each collective agreement, or other information sharing agreements that may apply, would govern what and how much personal information must be disclosed. Agreements should also include provisions to ensure that any personal information disclosed will be used only for authorized purposes and is kept secure and confidential.

Yes. Under POPA, there is no reasonable expectation of privacy in public settings. When students or employees participate in public events on campus (e.g., convocations, performances, sports), it is not considered an unreasonable invasion of privacy to take or publish photographs that document participation.

However, ��ݮ����Ƶ���� and media are expected to act professionally and respectfully, and individuals should be informed where possible if photography will be occurring through adequate signage at public events. If an individual is going to be featured prominently in any media that will be created or distributed by ��ݮ����Ƶ���� promotional or other purposes, then it is recommended that you obtain signed media recording waiver and release forms. 

Yes. Under POPA, ��ݮ����Ƶ���� may issue ID cards containing personal information (e.g., name, photo, student number) as long as:

• The information is collected for a legitimate purpose relating to a ��ݮ����Ƶ���� operating program or activity (e.g., access to services),
• Students are informed of the purpose at the time of collection, and
• The card remains in the custody and control of the student.

Students should not be required to surrender their ID cards to access services unless necessary for verification purposes.

Written consent is preferred. While POPA does not explicitly prohibit verbal consent, it requires that consent for the use or disclosure of personal information be:

• Informed,
• Voluntary, and
• Documented where possible.

If photography is a routine part of a program (e.g., athletics, performing arts, etc.), this should be disclosed at the time of registration. For non-routine promotional use, written consent should be obtained using a signed media recording waiver and release form. 

Yes. Under sections 12 and 13 of POPA, personal information in ��ݮ����Ƶ����’s alumni records may be used or disclosed for the purposes of its own charitable and fund-raising activities, which includes its alumni engagement program. 

Students are notified of this disclosure at the time of admission and when they apply to graduate, and alumni have the right to opt out of communications or mailing lists.

No. A graduate’s home address is considered personal information under POPA and may not be disclosed in the ordinary course without consent or otherwise in compliance with POPA.

Yes, with care. While media requests are not treated differently under the law, ��ݮ����Ƶ���� should ensure that any disclosure complies ATIA and POPA, and notify Communications and Community Engagement when responding to media inquiries to ensure consistent messaging and preparedness.

Yes. Under POPA, it is permissible to disclose information about publicly observable achievements (e.g., awards, honorary degrees, public recognitions) without consent.

If the recognition is not public (e.g., internal awards), written consent should be obtained before publishing or announcing the information.

Yes, with consent. While in some circumstances disclosure of student names and accomplishments is permitted without consent, but it is always recommended that written consent be obtained before releasing names or contact information to elected officials. Alternatively, officials may:

• Include congratulatory letters in graduation kits,
• Attend public ceremonies, or
• Or publish general messages in local media.

Yes. ��ݮ����Ƶ���� may allow media to cover public events on campus. Participation in such events implies no expectation of privacy, and ��ݮ����Ƶ���� retains the right to determine how and when media may participate.