Update of May 2, 2024
After looking at the university’s denial of my access request which they based on an exemption for “research information,” I decided that failing to disclose information about matters of significant public concern by calling it “research information” was not within the spirit of a public policy of accountability and transparency. My request did not ask for any research data. It questioned policies and protections. I continue to believe the public has a right to know what this public institution did and will do with respect to the questions raise. An appeal to the Commissioner over their denial has now been filed.
Original Post Follows
In June 2023, DataBreaches.net (DataBreaches) submitted a complaint and inquiry to Canada’s Commissioner of Privacy and Alberta’s Information and Privacy Commissioner (OIPC). The complaint concerned a data leak involving mental health-related information collected by university researchers. A member of the public discovered the leak and brought it to DataBreaches’ attention with a question about whether consent had been obtained to collect data for research on “mental health.” The U. of Alberta had not answered my questions about that.
In March 29, there was an update to the matter. As described at the time, U. of Alberta thanked me for making them aware of the unsecured data, but still declined to answer simple questions about consent, claiming, “in the interest of maintaining information security we will not be communicating with you further about this matter.” Neither of the two questions posed to them had asked anything about infosecurity.
In their letter, they also wrote, “As an institution subject to Alberta’s *Freedom of Information and Protection of Privacy (FOIP) Act*, we will cooperate with OIPC with any further investigation.”
DataBreaches then filed under the Freedom of Information and Protection of Privacy (FOIP) Act and made a number of requests, as previously reported.
Yesterday, we got a reply. You can probably guess by now what it was: a denial based on a claimed exemption:
Research information of an employee of a post-secondary educational body is excluded from the application of the FOIP Act under section 4(1 )(i). This means that the FOIP Act does not apply to information excluded under section 4.
Since the information/records you have requested is specifically excluded from the application of the FOIP Act, no records are being provided in response to your request.
The university’s full response appears below. DataBreaches has forwarded it to OIPC asking that office again why the public cannot get simple and straightforward answers about consent:
It should not be so impossible to obtain information from a public institution conducting research whether or not they need consent to collect publicly available material that they then code and process as “mental health.” Nor should it be so impossible to find out if they are collecting information from minor children without the knowledge or consent of the child or their parents.
It is now up to Alberta’s Information and Privacy Commissioner to determine if there is an issue for them to address.
Updated: On May 2, DataBreaches asked the OIPC to review the university’s denial. Seeking information about whether the university needed, sought, and/or obtained consent is not the kind of research information that should be shielded from public scrutiny. We’ll see what the province’s regulator thinks.