Access to Information for Studies and Research

The University of Alberta (U of A) may make available information including personal information that is deemed necessary to conduct approved studies of the University. The Access to Personal Information for Research and Studies Procedure sets out the process to be followed in order to obtain approval to use and disclose personal information under the custody or control of the University for the purposes of performing a study, a survey or research.

Disclosure for Research or Statistical Purposes

Section 15 of the Protection of Privacy Act (POPA) enables a public body to disclose personal information to a person other than a public body for a research purpose, including statistical research, only if:
  • the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form or has been approved by the Information and Privacy Commissioner;
  • any data matching is not harmful to the individuals the information is about and the benefits to be derived from the data matching are clearly in the public interest;
  • the head of the public body has approved conditions relating to the following:
    • security and confidentiality;
    • the removal or destruction of individual identifiers at the earliest reasonable time;
    • the prohibition of any subsequent use or disclosure of the information in individually identifiable form without the express authorization of that public body; and
  • the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, POPA and POPA Regulations,  and any of the public body's policies and procedures relating to the confidentiality of personal information.

The provision enables research to take place while also ensuring that privacy is protected. This is accomplished by the strict conditions set out above. Prior to disclosing personal information for research purposes under this provision, a public body must ensure that all requirements are met. The University will only consider requests for access to Personal Information for research purposes if the researcher has received the necessary approvals to conduct the research. 

As a public body under POPA, the U of A:

  • must ensure the collection, use, disclosure, protection and disposal of personal information is compliant with the requirements of POPA and associated regulations, the records management and archival policies of the university;
  • may create non-personal data for the purpose of research and analysis; maintain a record which includes a description of the personal information or data derived from the personal information used; and ensure that the identity of the individual who is the subject of the non-personal data cannot be identified or re-identified from the data;
  • may use non-personal data for any purpose but must only disclose non-personal data pursuant to Part 3 of POPA; 
  • may carry out data matching to create data derived from personal information for the purpose of research and analysis and other limited authorized reasons. However, data derived from personal information can only be used for the purpose for which it was created; and
  • is prohibited from disclosing data derived from personal information, unless the disclosure is to a public body the U of A collected personal information from for data matching. 

Definitions

    • Having custody of a record, that relates to University operations, means having physical possession of it.
    • Having control of a record means having the power or authority to manage, restrict, regulate or administer the use or disclosure of the record.
    • Data derived from personal information means data created by data matching, and that identifies any individual whose personal information was used in the data matching. 
  • Data matching means linking personal information between two or more databases or other electronic sources of information.
  • Non-personal data means data, including data derived from personal information, that has been generated, modified or anonymized so that it does not identify any individual, and includes synthetic data and any other type of non-personal data identified in the POPA regulations.
  • Personal Information means recorded information about an identifiable individual, including but not limited to: name, home address, personal email address, age, and an identifying number assigned to the individual.
  • Synthetic data means artificial data created to maintain the structure and patterns of real data without being linked to any individual in the original data set.
  • Examples of public bodies include post-secondary institutions, Government departments, municipalities, and health authorities.


For more information about POPA, visit the Government of Alberta’s website.