Facts

Canada’s three major research funding agencies include: the Canadian Institutes of Health Research (CIHR), the Natural Sciences and Engineering Research Council of Canada (NSERC), and the Social Sciences and Humanities Research Council (SSHRC), collectively referred to as the “Tri-Agency.”

McGill University (the University) is required to maintain a Responsible Conduct of Research (RCR) Policy to meet obligations set out in the Tri-Agency Framework: Responsible Research Conduct (2016). The Framework governs institutions applying for and managing Tri-Agency funds, including performing research, disseminating results, and processes institutions must follow for breaches. Institutions receiving funding must have policies to comply with Tri-Agency Framework requirements.

Dr. Philip Dickinson is a neuroscientist and Vanier Scholar. During his doctoral studies at the University, he developed a research project regarding the impact of beta-blockers on the autobiographical memory of hypertensive patients. He authored CIHR grant applications to fund the research but was not able to apply directly for CIHR funding because, at the time, he was a doctoral student. Instead, he worked with his supervisor, Dr. Pruessner, to submit CIHR grant applications, acknowledging his contributions and listing him as a co-applicant.

After unsuccessful applications, Dr. Pruessner applied to the CIHR “2016 1st Live Pilot Project Grant” competition, excluding Dr. Dickinson as a co-author and removing all acknowledgments of Dr. Dickinson in the proposal. The application was successful and received CIHR funding.

When the grant was awarded in July 2016, Dr. Pruessner no longer wished to pursue the project, instead wanting to use the funds for other research. The CIHR funds were not returned, but redirected to Dr. Nader, also a professor at the University, for another research project related to testing new treatments for smoking addictions, differing significantly from the research project for which the funds were granted.

"When a commission adopts an investigator’s recommendations and provides no reasons or only brief reasons, courts will treat the investigation report as constituting the commission’s reasoning for the purposes of reviewing a decision."

In March 2020, Dr. Dickinson submitted a research misconduct complaint (the Complaint) against Drs. Pruessner and Nader to the University’s Research Integrity Office, alleging academic dishonesty, plagiarism, and misuse of grant funds contrary to CIHR policies. The Research Integrity Office dismissed the Complaint in October 2020, finding no research misconduct or evidence of violation of the guidelines on ethical behaviour in research. An investigation found that Dr. Pruessner’s conduct, in excluding Dr. Dickinson in the 2016 application, was an “inadvertent omission.”

In December 2020, Dr. Dickinson escalated his concerns to the Secretariat on Responsible Conduct of Research (SRCR), complaining of institutional non-compliance (INC Complaint) by the University (the SRCR provides substantive and administrative support to the Panel on Research Ethics (PRE) and the Tri-Agency). The INC Complaint alleged plagiarism and  a breach of Section 3 of the Tri-Agency Guide on Financial Administration (failure to administer funds in a manner consistent with the funding opportunity description).

In April 2021, Dr. Dickinson wrote to the SRCR and to the CIHR President, expressing concern with the lack of progress regarding his complaint. In May 2021, the SRCR responded with details about the procedure, noting that an independent external reviewer would be appointed. In July 2021 an external reviewer was selected. In August 2021, Dr. Dickinson objected to the external reviewer, noting that a reviewer with no previous relationship with either the Tri-Agency or the institutions would be more suitable. The SRCR agreed and undertook to select another external reviewer.

In September 2022, the SRCR received the external reviewer’s final report. In February 2023, the Panel recommended that the Tri-Agency Presidents accept the external reviewer’s report, reprimand Dr. Pruessner, and declare the INC Complaint file closed. 

In April 2023 – 28 months after the INC Complaint was made – the Tri-Agency Presidents issued their decision by way of a brief letter to the University (the Decision), with a copy to Dr. Dickinson, dismissing the complaint. The letter accepted the external reviewer’s conclusion that the University did not breach the Tri-Agency Framework, apologized for the delay in communicating the final decision, and acknowledged the University’s efforts to facilitate the process.

Cause of Action

Dr. Dickinson sought judicial review, submitting that the Decision was not reasonable, the process for determining his complaint was procedurally unfair, and the investigation and decision-makers were biased.

Legal Issues

The two key issues in the application included whether the Decision was reasonable, and whether Dr. Dickinson was afforded the level of procedural fairness owed to him in the circumstances.

Decision

The application for judicial review was granted, with costs. The Tri-Agency Decision was unreasonable. 

The Tri-Agency Presidents were ordered to redetermine Dr. Dickinson’s complaint of institutional non-compliance by the University. The Attorney General of Canada was ordered to pay costs to Dr. Dickinson in the amount of $1000.00.

Reasons

Tri-Agency Reasons

When a commission adopts an investigator’s recommendations and provides no reasons or only brief reasons, courts will treat the investigation report as constituting the commission’s reasoning for the purposes of reviewing a decision (Sketchley v. Canada (Attorney General), 2005 FCA 404 at para 37). In the Court’s view, the same principle applied in Dr. Dickinson’s case: the reasons of the Tri-Agency Presidents were brief, adopting the reasons of the external reviewer. The Court was therefore compelled to regard the external reviewer’s reasons as the reasons of the Tri-Agency Presidents.

 Assessing Reasonableness: Information Considered by the Court

The information considered by the Tri-Agency Presidents in making the Decision was set out in the Certified Tribunal Record (CTR), comprised of:

• Two briefing notes;
• Dr. Dickinson’s INC Complaint;
• The final report of the University’s Research Integrity Office investigation;
• Responses from Dr. Pruessner and Dr. Nader;
• Comments from Dr. Dickinson and the University regarding the SRCR external reviewer’s draft report; and
• The SRCR external reviewer’s final report.

As a general rule, new evidence (not part of the record before the decision-maker) is only permitted on judicial review on an exceptional basis (Association of Universities and Colleges of Canada v. Canadian Copyright Licensing Agency (Access Copyright), 2012 FCA 22 at paras 19-20). Recognized exceptions include evidence that: 1) provides general background information that may assist in understanding the relevant issues but does not add new evidence on the merits; 2) draws the attention of the reviewing court to procedural defects that cannot be found in the decision-maker’s record; and 3) highlights the absence of evidence before the decision-maker on a particular finding (Access Copyright at para 20). 

In this case, the Court found that many additional documents provided essential background information and/or highlighted the absence of evidence before the Tri-Agency Presidents (falling within the Access Copyright exceptions). Additionally, while only the CTR documents were provided to the Tri-Agency Presidents to make their decision, they adopted the SRCR external reviewer’s final report. The documents considered by the external reviewer could therefore be considered by the Court in assessing the reasonableness of the Decision.

"... the Decision of the Tri-Agency Presidents dismissing the Complaint against the University was not reasonable with respect to the finding that the redirection of grant funds to a different project complied with the Tri-Agency Framework."

Redirection of Funds: Was the Tri-Agency Decision Reasonable?

The presumptive standard of review for administrative decisions is reasonableness (Canada (Minister of Citizenship and Immigration) v. Vavilov, 2019 SCC 65 at para 25). A reasonable decision is one that is based on an internally coherent and rational chain of analysis, justified in relation to the facts and the law (Vavilov, para 85) and where the reasons for the decision are justified, intelligible, and transparent (Vavilov, para 95).

On judicial review, courts do not reweigh and assess the evidence that was before the decision-maker, however, decisions must be justified in light of the facts (Vavilov, paras 125-126). For a decision to be set aside as unreasonable, the reviewing court must find serious shortcomings or flaws that are central to the decision. This may include irrational reasoning or an indefensible outcome in light of the relevant factual and legal constraints (Vavilov, paras 100-101).

Here, the Court found that the Decision of the Tri-Agency Presidents dismissing the INC Complaint against the University was not reasonable with respect to their finding that the redirection of the grant to a different project complied with the Tri-Agency Framework. Specifically, the Court held that the conclusion that the redirection of funds granted to a different project and a different researcher did not breach the Tri-Agency Framework was unreasonable, lacked analysis and ignored the evidence. The Court noted that the external reviewer failed to consider relevant agreements in determining whether deviation from the proposed research was permitted, relying exclusively upon his own subjective knowledge of Tri-Agency research funding in concluding that there was no breach of the Framework, despite being appointed to provide an objective assessment of the allegations based on the facts.

The Court held that the Decision dismissing Dr. Dickinson’s allegation of institutional non-compliance with the Tri-Agency Guide on Financial Administration (redirection of funds in breach of the Tri-Agency Framework) was not reasonable, directing the Tri-Agency Presidents to redetermine the complaint.

Costs

Per Rule 400 of the Federal Court Rules, the Court has discretion to determine whether costs should be awarded and in what amount. Factors include: result of the proceeding; importance and complexity of the issues; the amount of work; conduct of the parties, whether any steps in the proceeding were improper, vexatious or unnecessary, or any other matter that the Court considers relevant (Francosteel Canada Inc. v. African Cape (The), 2003 FCA119).

In this case, the result of the proceeding was the most relevant factor, carrying significant weight. As a general rule, costs follow the event (Merck & Co. Inc. v. Novopharm Ltd., 1998 CanLII 8260 (FC), para 24). In the Court’s view, the outcome of Dr. Dickinson’s application supported a costs award. 

Dickinson v. Canada (Attorney General), 2024 FC 1480 (Federal Court of Canada).

Authored by Anna Zadunayski LLB, MSc. 

Subscribe Here!

Facts

In 2021, the Office of the Information and Privacy Commissioner of Ontario (IPC) received a complaint from a student (the Student) at McMaster University (the University) regarding use of proctoring software for exams conducted remotely and online. The software used was Respondus LockDown Browser and Respondus Monitor. The Student raised concerns that the University was inappropriately collecting student data via the software and was unsure how the University was using, disclosing and disposing of personal information gathered by the software.

The complaint was brought during the height of COVID-19 restrictions. The University began using Respondus LockDown Browser and Respondus Monitor to administer remote assessments in 2020, the first year of the pandemic. LockDown Browser is custom software that locks down a testing environment within a learning management system by making temporary changes to student computer settings to control or restrict access to computing resources. During assessments, students are unable to navigate away from the assessment screen, conduct an internet search or access computer files.

Respondus Monitor analyzes video and audio of students during exams with the aim of ensuring academic integrity (scanning for possible cheating). It accesses a student’s webcam and records them during an exam, acting as a form of virtual invigilation. Recordings include real time biometric information (facial expressions, body posture and positioning, direction of gaze and verbal elements), analysed using artificial intelligence (AI) to flag suspicious activities consistent with cheating.

In this case, where an assessment was flagged, instructors were informed and could review the exam recording via the University’s Academic Integrity Office. Instructors could not access recordings without authorization from the Academic Integrity Office pursuant to an academic integrity investigation. After implementing Respondus software in 2020, there were two cases where recordings were reviewed as part of an investigation. In both cases, students were charged with academic misconduct. Recordings provided integral evidence documenting the misconduct. 

Cause of Action

The Student did not consent to the IPC sharing their name or a copy of their complaint with the University. Instead, the IPC opened a Commissioner-initiated complaint to address the University’s use of the Respondus exam proctoring software. 

Legal Issues

The legal issues included whether student information was being collected, used and protected by the University in accordance with the Freedom of Information and Protection of Privacy Act, R.S.O. 1990 (the Act). Did the University have reasonable contractual and oversight measures in place to ensure student privacy in accordance with Regulations made under the Act?

Decision

While the IPC acknowledged that conducting exams and appointing examiners was a lawfully authorized University activity, it concluded that Respondus Monitor collected sensitive personal information (including biometric information) and used AI, carrying heightened privacy concerns.

The University had not provided adequate notice for its collection of the information as required by section 39(2) of the Act. Use of students’ personal information through Respondus Monitor did not comply with section 41(1) of the Act.

"Student names, course information, photo identification, biometric data, and audio and video recordings are “personal information” as defined  in section 2(1) of the Act."

The contractual arrangement between the University and Respondus did not adequately protect the personal information collected, permitting Respondus to use that information for system improvement purposes without student consent.

The IPC made recommendations for the University to bring itself into compliance with the Act. Given the heightened risks associated with AI technologies, the IPC recommended additional guardrails to incorporate stronger protections in ongoing use (and future agreements) of exam proctoring software. The University was required to report back to the IPC about implementation of the recommendations within six moths of receiving the investigation report. 

Reasons

Was Student Information Collected, Used and Protected in Accordance with the Act?

Student names, course information, photo identification, biometric data, and audio and video recordings are “personal information” as defined in section 2(1) of the Act. The IPC found that although collection of personal information via Respondus software complied with section 38 of the Act (necessary collection of personal information), the University’s notice of collection to students did not comply with section 39(2) of the Act.  

Use of personal information via Respondus LockDown Bowser on behalf of the University was authorized under section 41(1) of the Act, however use of personal information via Respondus Monitor for product improvement purposes was not.

Were Contractual and Oversight Measures Sufficient to Ensure Student Privacy?

In the IPC’s view, contractual and oversight measures in place were not sufficient to ensure privacy and security of student information (mandated by the requirements of section 4(1) of Ontario Regulation 460 and section 4(1) and 5 of Ontario Regulation 459, made pursuant to the Act). To enhance student privacy, the IPC recommended that the University consolidate its notice of collection of personal information in a clear, comprehensive statement so that students could access the information without having to navigate numerous sources.

The IPC directed the University to secure a written undertaking from Respondus to stop using personal information for service improvement or training and stop disclosing personal information to subcontractors for research purposes, absent student consent. The IPC recommended that the University enter into a more restrictive, particularized agreement, including: 

1) Confirmation that Respondus would treat all recordings as personal data;

2) In cases of compelled disclosure by government or law enforcement, Respondus would provide the University with prompt notice, seeking an appropriate remedy to prevent or limit such disclosure; and

3) A contractual requirement that Respondus confirm the deletion personal data from its servers on an annual basis.

The University was also advised to conduct tests confirming that uninstalling Respondus software actually resulted in removing the totality of the software, with no remnants remaining.

Mitigating Heightened Privacy Risks of Online Exam Proctoring

The IPC noted the heightened privacy risks associated with automated online exam proctoring, compared to in-person tests. Recordings focus upon individual students, often in their home setting, potentially capturing extraneous background information about living environment and conditions, providing information that a student may not wish to share and raising the risk of unfair allegations based on inaccurate information.

Given the heightened privacy risks associated with use of AI-enabled exam proctoring software, the IPC recommended several additional guardrails for the University to: conduct an algorithmic impact assessment; consult with student representatives (particularly from vulnerable or historically marginalized groups); provide students with an opportunity to opt out of online exam proctoring and choose in-person invigilation instead; and provide a less formal process for challenging identified academic integrity flags. 

McMaster University (Re), 2024 CanLII 17583 (ON IPC) (Ontario Information and Privacy Commissioner).

Authored by Anna Zadunayski LLB, MSc.

Implications and Applications

The integration of AI into the educational setting raises important questions, from the ethics of generative AI in student learning to protection of student privacy. Based on the recent McMaster University privacy review, educational institutions should:

• Understand the heightened privacy risks associated with AI technologies.
• Provide clear and adequate notice to students regarding collection of personal information (notice of collection and use of personal information must comply with applicable privacy legislation).
• Consolidate notice of collection of personal information in a clear, comprehensive statement (enable students to access this information without having to navigate multiple sources).
• Review and monitor contractual agreements with service providers (contractual oversight measures must ensure the privacy and security of student information).
• Ensure that service providers are not using personal information for research or development purposes, absent student consent.
• Test the software to ensure that uninstalling the software will remove the totality of the software with no remnant remaining.
• Provide students with the opportunity to opt out of online exam proctoring (and choose in-person invigilation instead).
• Implement safeguards and protections for ongoing use of exam proctoring software.

Subscribe Here!

Facts

The student residences at the University of Lethbridge (University) include townhouse, dormitory and multi-resident units of varying age, construction class and economic life. As improvements on University-owned lands within the City of Lethbridge (City), they are subject to municipal property tax assessments. A July 2021 City Property Tax Assessment valued the University lands and improvements at $478,931,000.00. The student residence improvements accounted for $28,113,350.00 of that amount.

The University appealed the assessment to the City of Lethbridge Composite Assessment Review Board (CARB), taking issue with the taxable value of the student residence improvements. Specifically, the University disputed the fairness of the City’s valuation methodology and its calculation of external depreciation or obsolescence.

The University’s appeal was successful. The CARB reduced the assessed value of the student residences to $23,919,857.00, resulting in a final tax assessment of $473,467,500.00.

Cause of Action

The City sought judicial review of the decision, arguing that the CARB reasons were conclusory in nature and failed to explain how the evidence was weighed or issues were analyzed. The City claimed that the CARB failed to provide transparent, justified and intelligible reasons.

In response, the University argued that the CARB decision, when considered as a whole, and in the context of the evidentiary record and submissions, was intelligible, transparent and justified.

Legal Issue

The legal issues on judicial review included the reasonableness of the CARB decision, together with the calculation of the age of the student residence improvements.

Decision

The Court upheld the CARB decision as being intelligible, transparent and justified. The CARB considered the unique nature of the student residence improvements and applied the considerations set out in the Municipal Government Act, RSA 2000 (the “Act”), to ensure a fair and equitable tax assessment.

The City and University age life expectations deviated by one year on each of the student residence improvements. The University calculation of age life expectancy was incorrect, rendering each residence one year older than it would have been based upon physical condition and characteristics. The CARB, relying upon the University’s calculation, imported the error into the final quantified figure, requiring correction so that the final calculation was based upon an accepted methodology. The matter was remitted back to the CARB only to recalculate the tax assessment using the proper age life expectancy for each residence.

"A reasonableness review examines the reasons of the administrative decision maker, which must demonstrate an internally coherent, rational chain of analysis, justified on the facts of the case and the applicable law."

Reasons

Standard of Review

Reasonableness is the presumptive standard of review for administrative decisions (Canada (Minister of Citizenship and Immigration) v. Vavilov, 2019 SCC 65). Reasonableness engenders respect for the expertise of administrative decision makers, requiring courts to exercise restraint and intervene only to safeguard the legality, rationality and fairness of the administrative process. Deference is required. Courts are not on a treasure hunt for error.

A reasonableness review examines the reasons of the administrative decision maker, which must demonstrate an internally coherent, rational chain of analysis, justified on the facts of the case and the applicable law. A decision is reasonable if there are no fatal flaws in logic and the analysis flows logically from the evidence to the result. It falls to the party seeking review to demonstrate that the decision is unreasonable.

Sufficiency of Reasons

In this case, the City argued that the CARB failed to demonstrate how it arrived at its reasons. In the Court’s view, the CARB reasons provided a comprehensive overview of the arguments, explaining why the University’s consistent approach to valuation was preferred. The CARB decision noted that cases relied upon by the City were distinguishable as they did not relate to student residences. By contrast, the cases relied upon by the University included decisions relating specifically to University student residences, demonstrating how matters of cost and obsolescence had previously been dealt with.

"In assessing external depreciation and quantifying obsolescence, it is necessary to reconcile the difference between the market value of a typical multi-family property and the market value of similar-in-form but atypical-in-function student housing."

In assessing external depreciation and quantifying obsolescence, it is necessary to reconcile the difference between the market value of a typical multi-family property and the market value of similar-in-form but atypical-in-function student housing. The Court found that the CARB assessed the fair and equitable value of a unique form of improvement with no other market comparable. 

Assessment Review Board

An assessment review board is empowered under section 467 of the Act, to change an assessment roll or decide that no change is required. It must not alter an assessment that is fair and equitable. In conducting a review, a board must regard valuation standards and procedures set out in the regulations, along with the assessment of similar property in the same municipality. As student residences do not generate a consistent income stream or attract comparative market data, they are typically valued using a cost approach requiring an estimate of the cost to construct the facility new, age life expectation, and depreciation specific to student residences.

Student Residences Valuation

The City applied a hybrid approach to establish cost (determining the cost of new construction, then calculating depreciation) – the same approach used to value all properties in the municipality. The University, on the other hand, relied upon a cost quantification specific to student residences. The CARB was satisfied that the University approach provided a consistent cost calculation for all aspects of the valuation including the cost of new construction, age life expectation and depreciation, and depreciation schedules specific to student residences.

The Court held that it was reasonable for the CARB to accept the University approach given the unique nature of student residence improvements and the lack of available market data comparable to such improvements. Given the unique nature of the student residence improvements, it was reasonable for the CARB to reject the City’s method used to value all property types in the municipality.

City of Lethbridge v. University of Lethbridge, 2024 ABKB 23 (Alberta Court of King’s Bench).

Authored by Anna Zadunayski LLB, MSc.

Subscribe Here!

Facts

The Applicant was a student at Aurora College (College) in Yellowknife and living in student housing in the 2020-21 school year. Public health officials made orders under the Public Health Act to slow the spread of COVID-19, including requirements for certain travelers to complete and submit self-isolation plans (SIPs). Travelling in and out of the Northwest Territories involved more planning than usual during the pandemic. Travelers required an approved SIP even if they were residents returning home. Any person exposed to the virus was expected to self-isolate for 14 days and monitor for symptoms.

In March 2020, the Minister of Health and Social Services declared a public health emergency in the Northwest Territories. The Chief Public Health Officer directed people to self-isolate if they met certain criteria. To support the public health orders, the government provided information and resources including a toll-free ‘811’ telephone number that people could call with questions (and to report suspected breaches of public health orders).

The College required student housing tenants to provide information about their SIPs and related details as part of an effort to promote the health and safety of its students. The Applicant lived in student housing in a building that was not owned by the College – an apartment complex where the College leased apartment units used to provide student housing. The building was owned by a corporation that was not a public body subject to the Access to Information and Protection of Privacy Act, SNWT 1994, c 20 (ATIPPA). Student parking was not provided by the College but arranged separately with the building owner.

The College requested those in student housing to provide details of their personal travel and SIPs. The Applicant complied with this request in December 2020 and again in January 2021, providing travel dates and SIP numbers. Separately, in May 2021, the Applicant’s parking privileges were interrupted without notice. The Applicant left student housing to attend an appointment and upon return was unable to re-enter the parkade. The code had been changed by a security guard, who may have thought the Applicant was breaching a public health order by leaving the building. Why the security guard felt empowered to take such action was unclear, as building security had no legal authority to investigate or enforce public health orders.

Three days prior to the ‘parking lot incident’ a security guard emailed the Campus Director of the College advising that the Applicant had been leaving the residential unit even though the Applicant was ‘in isolation.’ The guard advised that 811 would be called if the Applicant was seen outside the residential unit again.

The security guard was not employed by the College. The College stated that it did not communicate the Applicant’s self-isolation status and did not know how the security guard learned the information. A student resident’s personal information would be kept in the student residence file, accessible by the Residence Officer. Information about a student in isolation would be released to the building security only if it were necessary to enter a unit in an emergency.

"The legal issue was not whether the collection of information was a good policy approach given the public health crisis, but whether the collection was legal."

Cause of Action

The Applicant asked the Information and Privacy Commissioner (IPC) to review the legal authority for the College to collect, use or disclose students’ personal information regarding COVID-19 isolation status, self-isolation plans, and other related information.

Legal Issue

Some personal information was collected by the College as information obtained as part of the student housing records. The information of concern in this case was the additional information related to the Applicant’s COVID-19 health status. The legal issue was not whether the collection of information was a good policy approach given the public health crisis, but whether the collection was legal.

Decision

The IPC found that the collection of student information about SIPs from student housing residents was not authorized under ATIPPA. Because the Applicant’s personal information was disposed of by the College (according to its procedure of disposing of such records upon a resident leaving student housing) there was no need for a section 49.5(b) order compelling destruction of the information.

To prevent a future privacy breach, the IPC recommended that the College review its bylaws, policies and procedures to ensure compliance with the legal requirements of ATIPPA, particularly sections 40, 43 and 47. The IPC asked the College to stop collecting personal health information of students living in student housing unless the information directly related to (or was necessary for) management of the residence.

Reasons

Jurisdiction

Aurora College is a designated public body under section 1 of the Access to Information and Protection of Privacy Regulations, and as defined in ATIPPA section 2. Part 2 of ATIPPA addresses protection of privacy and imposes limits on the collection, use and disclosure of personal information by a public body. Section 49 provides that a person may request the IPC to review whether a public body has collected, used or disclosed an individual’s personal information in contravention of the Act. As such, the subject matter of the review was within the IPC’s jurisdiction.

"The IPC asked the College to stop collecting personal health information of students living in student housing unless the information directly related to (or was necessary for) management of the residence."

How the security guard learned of the Applicant’s isolation status was unknown. There was no evidence that the College provided the information. The building owner was a private corporation not subject to ATIPPA. The IPC did not have jurisdiction to investigate the security guard’s actions.

Collection Legally Authorized?

Early in the pandemic, the College asked students to identify themselves to the Residence Officer or Campus Director if they were required to self-isolate due to COVID. College staff were instructed to record information regarding number of occupants in a unit, contact information, whether the person had contacted Public Health, what advice was given, and whether the person had a support plan for isolation. By August 2020, the College had a protocol for students who were required to isolate, requiring submission of an approved SIP from ProtectNWT to the Residence Officer, with a copy to the Campus Director. Residence staff would contact students by email regarding isolation plans, along with resources and supports for impacted individuals.

A public body is not allowed to collect personal information unless it is for one of the reasons set out in ATIPPA section 40. This restriction functions as a fundamental protection of individual privacy: a public body cannot collect individuals’ personal information except as allowed under section 40. A public body cannot lawfully collect personal health information simply because an individual consents to provide it. Authorization must be found in ATIPPA section 40. While College bylaws and policies may have directed collection and management of information during the COVID-19 pandemic, bylaws and policies are not ‘legal enactments’ and could not supersede ATIPPA section 40(a) to justify collection.

The Aurora College Act, RSNWT 1988, c A-7, authorized the President to manage student residences. It did not empower the College to provide health services or conduct Public Health Act investigations. The pandemic posed serious operational challenges for many institutions. In the IPC’s view however, collecting students’ personal health information regarding COVID status and related details was not legally authorized and went beyond what was directly related to and necessary for management of the student residences.

Re Aurora College, 2024 NTIPC (Northwest Territories Information and Privacy Commissioner).

Authored by Anna Zadunayski LLB, MSc.

Subscribe Here!