The University of Alberta has submitted a Privacy Impact Assessment (PIA) to the Office of the Information and Privacy Commissioner in relation to its plans to outsource its email services to Google.
The University has an obligation under the Freedom of Information and Protection of Privacy Act (FOIP) to protect personal information and Commissioner Frank Work acknowledges the University’s efforts to address privacy implications.
Work says the University has done what it reasonably can to ensure the protection of personal information. “However, users of the University email system must be informed that their emails will reside in a foreign jurisdiction and will be subject to the laws of that jurisdiction, such as in this case, the USA Patriot Act. Individuals can then make an informed decision about what kind of information they will transmit through email. The University has agreed to inform the student body and employees that it won’t be able to guarantee protection against possible disclosure of emails residing in the United States.”
The University has confirmed to the Commissioner’s Office that it will accept his recommendations.
Work says other Public Bodies and organizations considering similar initiatives would be well advised to consider developing Privacy Impact Assessments.