Frank Work, Information and Privacy Commissioner, had received a privacy complaint from the Alberta Union of Provincial Employees Local 038 (“AUPE”) against the Northern Alberta Institution of Technology (“NAIT”). AUPE questioned the amount of personal information collected by NAIT from its “Health Screening Questionnaire” and NAIT’s authority to collect this information.
AUPE filed its privacy complaint after NAIT made the decision to discontinue its use of the Health Screening Questionnaire. Therefore, the Commissioner’s Office determined that the complaint is not with the “form” used by NAIT to collect personal information but the collection itself.
The investigation found that NAIT collected personal information for two purposes: to assess a prospective employee’s ability to perform the duties and responsibilities of the position applied and to provide health services for its employees. The investigation determined that NAIT’s collection of personal information complies with section 33(c) of the Freedom of Information and Protection of Privacy Act, which allows a public body to collect personal information that relates directly to and is necessary for an operating program or activity of a public body.
However, the investigation also determined that the assessment of prospective employees and the delivery of health services to employees are separate and distinct programs/activities with different information requirements. Personal information collected may be relevant and necessary for one program/activity, but may not be relevant for the other.
By using one form to collect personal information for the two programs/activities, NAIT was at risk of collecting more personal information than was relevant or necessary from prospective employees, who did not become employees. However, as there was no evidence of a specific unauthorized collection, the investigation made no findings of a privacy breach.
Although NAIT is in the process of finalizing new guidelines and procedures, it has separated the collection processes for the two programs/activities. The investigation finds that the separate collection processes would remove any confusion relating to NAIT’s authority to collect such information and minimize the potential risk for unauthorized collection, use and disclosure of personal information.