October 25, 2000

I requested Mark Grady, Portfolio Officer in this Office, to make inquiries into these concerns and then to make, if appropriate, recommendations to me as to how universities could improve their practices concerning protection of alumni personal information.

I have received Mark Grady's October 24, 2000 report. I have reviewed it, with emphasis on his conclusions and recommendations. I agree with the views expressed in the conclusion to the report and with the recommendations he has made. I ask the universities to accept these recommendations, which I believe will improve their practices for protecting the personal information of university alumni.

ORIGINAL SIGNED BY

David Loukidelis
Information and Privacy Commissioner
   for British Columbia

1.0 PURPOSE OF THIS DOCUMENT

This report focuses on the policies and practices of three universities: Simon Fraser University, the University of British Columbia and the University of Victoria.

Mark Grady, Portfolio Officer, prepared this document with the assistance of Bill Trott, Portfolio Officer, and Lorrainne Dixon, Executive Director, Office of the Information and Privacy Commissioner.

2.0 BACKGROUND

The stories dealt primarily with special rates for insurance or credit cards that were being offered to university alumni and with concerns about receiving telephone calls at home from telemarketers, as well as promotional material through the mail.

Ann Rees, a staff reporter with 'The Province' newspaper, first wrote about the issue. She wrote that the practice came to light when she was contacted on her home telephone number by a telemarketer working for Meloche Monnex Inc., a company that sells group household insurance. Ms. Rees confirmed that the telemarketer told her the call was being made on behalf of Simon Fraser University Alumni Association.

From time to time, this Office receives inquiries about the sharing of mailing lists and telemarketing practices conducted by both the public and private sectors. This Office has not, however, received a complaint regarding British Columbia universities' involvement in marketing products or services to students or alumni.

3.0 JURISDICTION

Part 3 of the Act establishes minimum requirements concerning a public body's collection, use and disclosure of personal information. Each university identified in this report is a "public body" under the Act. Under the Act, "personal information" means recorded information about an identifiable individual. Generally, Part 3 of the Act applies to a public body's handling of personal information in its day-to-day activities rather than in response to an access request under the Act.

The Commissioner has the authority to investigate and to comment on the privacy issues, which arise from a university's collection, use and disclosure of student or alumni personal information. In this case, the universities' disclosure of personal information to alumni associations, companies or other organizations that are not "public bodies" under the Act is the primary concern. This report addresses these issues and includes recommendations to the Information and Privacy Commissioner for universities to improve their privacy protection practices where personal information is collected, used or disclosed for alumni purposes, especially for the marketing of products or services to alumni.

4.0 THE PROCESS FOLLOWED HERE

• review of media articles and reports concerning this issue,
• interviews of university staff responsible for the freedom of information program and alumni relations program at Simon Fraser University, the University of British Columbia and the University of Victoria,
• interviews of staff of the University of British Columbia Alumni Association,
• reviews and analysis of universities' forms and policies and procedures regarding the collection, use and disclosure of student and alumni personal information; agreements between universities and alumni associations concerning the use of alumni personal information; and agreements between universities and/or alumni associations and insurance companies or banks concerning the marketing of services or products to alumni,
• interviews of a staff member with the Alberta Information and Privacy Commissioner's Office regarding that Office's experience with this issue concerning Alberta universities and colleges,
• interviews of a staff member with the Ministry of Health regarding the ministry's experience with the use and disclosure of patient personal information for fund-raising purposes and
• review of written submissions from the University of Victoria, Simon Fraser University and the University of British Columbia concerning the collection, use and disclosure of alumni personal information in specific situations.

5.0 DISCUSSION

Each of the three universities identified in this report has a program with a goal of building and securing long-term support for the university, so that the university may achieve its mission or mandate. These "external relations" programs are intended to promote harmonious relationships between the university and governments, businesses, private individuals and graduates of the university. They also deal with other development or fund-raising initiatives, an issue that has become increasingly important in recent years with changes in public funding of university programs.

Within these external relations programs, there is a division or department that deals directly with alumni issues and relations. These university programs support alumni association activities and initiatives. (In this report, these programs are referred to as alumni relations programs ("ARPs"). From time to time, an ARP contacts university alumni directly, by telephone or mail, and asks alumni to make donations to the university for its programs. The ARP usually maintains a separate database of alumni personal information. This includes an individual's name, address, telephone number, student number, birthdate, university degree and faculty. This limited amount of personal information is transferred from the university's student database, maintained by the university's registrar, to the ARP at the time of a student's graduation. The ARP is responsible for, and controls access to, the alumni database. Other university programs may be given access to the personal information of a specific group of alumni. For example, a faculty of law may wish to invite law graduates to a special event such as a reunion. The ARPs apparently place conditions concerning the use, disclosure and retention of alumni personal information by other university programs.

For large mail-outs to alumni or students, the ARPs and other university programs use "mailing houses". These are bonded companies that place prepared material in envelopes, apply mailing labels and arrange for envelopes to be mailed. The university provides alumni names and addresses to mailing houses only in a computer disk. Agreements with the mailing houses include restrictions on the use and disclosure of the personal information, reasonable security measures and the return of computer disks after the material has been mailed.

Section 64 of the University Act creates the position of university registrar who is the secretary of convocation, the senate and each of the faculties, and who must keep the records and perform the duties that the board or senate may require. Section 2 of the University Act gives each university the authority to grant degrees.

Under s. 7 of the University Act, university registrars are required to continue, and keep up-to-date, the roll of convocation. That roll includes those who have graduated from the university. The registrar is required to conduct elections, including those where convocation members are entitled to vote. It should be noted that the ARP and alumni association forward most changes of alumni personal information to the registrar to allow for the appropriate corrections to the roll of convocation.

The University Act defines "alumni association" as "the association of graduates of a university, membership in which is open to all graduates of the university." Alumni associations are ordinarily nonprofit societies and, although they work closely with the universities, the associations are not part of the universities. Also, an association is not a "public body" under the Act. The University Act allows a university to collect fees on behalf of its alumni association (see s. 27, Powers of Board).

The ARP gives access to the alumni database to the alumni association so that it can register recent university graduates as members of the association. From time to time, the association contacts alumni members regarding university or association initiatives, including requests for alumni to make donations to the university for its programs.

Alumni associations become involved in promotional or marketing agreements with outside companies only where the association believes that there is a benefit to alumni. At this time, some associations are agreeing to promote special rates for insurance or credit cards for alumni members in certain age groups, for example "baby boomers."

In the past, ARPs or alumni associations made the alumni list directly available to the companies. It should be noted, however, that none of the three universities or alumni associations still does this. The university through its mailing houses now distributes information about products or services to alumni.

Alumni associations have written agreements with these insurance companies and banks allowing for distribution of promotional material to alumni. Again, in the past, the companies sent the material directly to alumni. In exchange, the alumni association receives payment for each application accepted or for an amount based on a dollar value for credit card transactions. The association uses this money for its own operational needs.

From time to time, alumni associations send "opt - out" notices to alumni allowing individuals to indicate that they do not wish to receive promotional or other material through the mail or they do not wish to be contacted at all. The alumni associations accept the individual's wishes so as not to jeopardize their long-term relationship with alumni.

5.2 Practices of Selected Universities - This section describes what this Office learned about the practices of selected universities in British Columbia.

Simon Fraser University ("SFU")

SFU and the Alumni Association of Simon Fraser University ("SFU Association") have a memorandum of understanding that confirms the alumni membership list is in the custody and under the control of SFU. The memorandum of understanding allows the list to be made available to the association for alumni purposes, including fund-raising and marketing alumni benefits and services. There is also provision for the list to be made available to external organizations or groups, if approved by SFU, and subject to policy, guidelines and fees determined by the association and SFU.

The SFU Association has agreements with two "affinity" partners. They are BANKONE International and Meloche Monnex Inc. Under the agreements, the SFU Association used to provide the partner with the list of alumni names, addresses and telephone numbers for solicitation or promotional purposes. SFU, or the SFU Association, no longer discloses the alumni list to companies. The partners acknowledge that the list is the SFU Association's property and that the alumni personal information will be used only for the purposes identified in the agreement. The partners also agree to keep the personal information in confidence, not to disclose the list to any third party or make a copy of the list, and to return the data disk when the agreement ends. The partners pay the SFU Association royalties for the use of the list or for visibility given to the partner at different SFU Association events. An amendment to the Meloche Monnex agreement confirms that the SFU Association has a proprietary interest in the list.

The recent Meloche Monnex promotional material sent by the SFU Association to its members includes an "opt out" notice that individuals can send to the insurance company if they do not wish to be contacted. The material also includes a notification, entitled "We respect your privacy", confirming that Meloche Monnex has signed an agreement to treat an individual's personal information confidentially and to preserve privacy.

During this investigation, SFU confirmed that it or the SFU Association would no longer disclose alumni mailing lists to outside companies or organizations other than the SFU association. SFU considers the SFU Association an "agent" of the university.

University of British Columbia ("UBC")

UBC's ARP has a policy and procedure regarding alumni records. The policy confirms that UBC retains the exclusive right of ownership of all information and that the policy applies to the sharing of the alumni records. Under the policy, UBC is responsible for the maintenance of accurate and up-to-date records of alumni and for security of the records. The policy also states that alumni records are to be used only for "genuine alumni or UBC related functions and not for commercial or political purposes." It goes on to say that some acceptable uses are alumni mailings or publications, planning class reunions and other UBC approved purposes. Although the policy does not allow for the use of alumni records for commercial purposes, there is provision for exceptions to this rule for the "discriminate commercial use of alumni records" by UBC programs, for example, the UBC Book Store or The Continuing Education Department.

University programs or outside companies given access to alumni records must sign an agreement of confidentiality with respect to the alumni personal information, and must agree to use the information for specific, identified purposes and not to disclose the information to any other party.

UBC does not, however, release alumni personal information to outside organizations or companies other than the UBC alumni association ("UBC Association") and mailing houses. Only a mailing list is provided to mailing houses. Where the UBC Alumni Association endorses a product or service believed to be a benefit to alumni, UBC's ARP arranges for promotional material to be distributed through a mailing house. The company providing the product or service simply prepares the promotional material.

Both UBC and the UBC Association are parties to an agreement with the Bank of Montreal concerning the promotion of a UBC credit card for alumni. The UBC Association agrees to promote the use of the credit card and, in return, the bank pays an amount to the UBC Association on a regular basis. The bank agrees to treat any alumni personal information confidentially and not to disclose it to any other party without the consent of UBC and the UBC Association.

The UBC Association also has an agreement with Manufacturers Life Insurance to provide alumni with promotional material concerning insurance products. The UBC Association did not provide details of this agreement.

University of Victoria ("UVic")

The UVic application to graduate form states that an individual's personal information may be provided to the UVic Association. After graduation, the UVic Association sends a "welcome" package of information to new alumni members. The package includes a return postcard for individuals to indicate if they wish to receive, from a list of items, additional information concerning specific products or services including special rates on insurance and credit cards.

UVic and the UVic Association have a memorandum of understanding confirming that the alumni membership list is in the custody and under the control of UVic. The MOU states that, subject to the Freedom of Information and Protection of Privacy Act, the membership list is to be made available to the UVic Association for its purposes. Also, the list may be made available to affiliated groups and external organizations, if approved by UVic, and subject to policy, guidelines and fees established by the association and UVic.

The UVic Association has an agreement with MBNA Canada Bank for the promotion of the bank's credit card. The agreement allows for the disclosure of alumni names, addresses and telephone numbers to the bank, to be used for mailing promotional material or for telephone contact. The bank agrees to use the personal information for this purpose only. In return, the bank pays royalties to the UVic Association from time to time. UVic officials have confirmed that, in response to a number of complaints from alumni, UVic now directly distributes any of the bank's promotional material to alumni through mailing houses.

The association also has an agreement with Meloche Monnex that used to allow the association to disclose alumni names, addresses and telephone numbers to the company for marketing of its insurance services. The company agrees to use the personal information for this purpose only and not to disclose it to any other party. In return, the company provides the UVic Association with financial consideration from time to time.

During this investigation, UVic confirmed that the UVic Association has changed its practice concerning the disclosure of alumni personal information to any commercial interest other than bonded mailing houses. The UVic Association will now disclose this personal information only with the "prior knowledge and consent of the member."

In early July this year, UVic mailed MBNA Canada Bank promotional material to alumni members. The return address shown on the envelope for this offering was for the bank in Ottawa. UVic has reported that an error was made in that the bank provided the wrong envelopes to the mailing house. UVic also confirmed that the material was sent by third class mail so any envelopes that could not be delivered were not returned to the bank. UVic will ensure that future mailings show the UVic Alumni Association's return address on the envelope.

University of Northern British Columbia ("UNBC")

5.3 Use of Alumni Mailing Lists in Alberta - The Alberta Freedom of Information and Protection of Privacy Act has applied to Alberta universities and colleges since September 1, 1999. In 1998, a select committee of the Alberta Legislature conducted a review of the effectiveness of the legislation after its first three years of operation. During this review, representatives of Alberta universities and colleges identified possible conflicts between the legislation and their current fund-raising practices concerning the use of alumni and other individuals' personal information.

The select committee made two recommendations to the universities and colleges regarding their use of alumni personal information for affinity programs with credit card and insurance companies. The committee concluded that it was acceptable to continue to use current alumni personal information for these affinity programs, provided current alumni were given an opportunity to remove their personal information from the lists disclosed for this purpose. However, the committee recommended that, for future alumni, the universities and colleges use a "positive consent" statement before alumni personal information could be disclosed to the credit card or insurance companies for these affinity programs.

5.4 Application of the Act - This section addresses application of the Freedom of Information and Protection of Privacy Act to the above activities.

Scope of the Act

During this investigation, the universities confirmed that ARPs collect personal information to create the alumni list when student personal information is transferred, at the time of graduation, from the registrar's student database to the ARP. As well, the ARP is responsible for revisions and access to the alumni list and for its security.

Therefore, despite different practices among the universities, I believe that the alumni databases, containing alumni personal information, are in the custody and under the control of the universities through their ARPs.

Part 3 (Protection of Privacy)

The Act defines "personal information" as:

	...recorded information about an identifiable individual, including
	(a) ...	the individual's name, address or telephone number,
	(c)	the individual's age, sex, sexual orientation, marital status or family status,
	(d)	an identifying number, symbol or other particular assigned to the individual,
	...
	(g)	information about the individual's educational, financial, criminal or employment history,
	...

In this investigation, the focus was on the universities' collection of students' personal information, its transfer to the alumni list and the disclosure of alumni personal information to organizations that are not public bodies under the Act.

Authority to Collect Personal Information

It is necessary for the registrar and other university programs to collect certain personal information related to the student's education at various times while the student is enrolled at the university. This includes collecting a student's personal information for reasons related to graduation from the university. As mentioned earlier, the University Act requires university registrars to keep the roll of convocation up-to-date. I believe ss. 2, 7 and 64 of the University Act give the university registrar the authority to collect personal information for administrative reasons related to a student's graduation and for the creation of the roll of convocation.

In my opinion, there is no obvious provision in the University Act that gives university alumni relations programs express authority to collect student or alumni personal information.

Section 26 also allows for the collection of personal information if it "relates directly to and is necessary for an operating program or activity of the public body." In the Policy and Procedures Manual for the Act ("ISTA Manual"), issued by the Information Science and Technology Agency of the Ministry of Advanced Education Training and Technology, an "operating program" is defined as "a series of functions designed to carry out all or part of a public body's mandate." An "activity" is defined as "an individual action designed to assist in carrying out an operating program."

It should be noted that, under s. 47 of the University Act, two primary functions of a university are to "provide instruction in all branches of knowledge and establish facilities for the pursuit of original research in all branches of knowledge." A university is also required to "promote and carry on the work of the university in all its branches, through the cooperative effort of the board, senate and other constituent parts of the university." Therefore, it is reasonable to say that a university's mandate is the promotion of higher learning and research.

A primary purpose of university ARPs is to promote continuing interest by alumni in university activities and initiatives, including through appeals for alumni to donate funds to the university for its operating programs. A number of these ARP initiatives and activities are undertaken in cooperation with the university's alumni association. To achieve their program objectives, ARPs (often working with university alumni associations) use various approaches to foster a positive relationship with alumni. The marketing of products and services as a perceived benefit to alumni is one of those approaches. I believe that s. 26(c) of the Act allows the ARP to collect personal information that relates directly to and is necessary for its operating program or activities and those of the university generally.

Manner of Collection

• of the purpose for the collection;

• the authority for the collection; and

• the title, business address and telephone number of a public body employee who can answer questions about the collection.
  

Use and Disclosure of Personal Information

• for its original purpose or for a use consistent with that purpose (see the discussion below concerning s. 34);
• for a different purpose, if the individual the information is about has identified the information and consented to the use for the different purpose; or
• for one of the permitted disclosures under ss. 33 to 36 of the Act (see discussion below concerning s.  33).

Under s. 33, a public body may disclose personal information only for a purpose for which the personal information was obtained or for a use consistent with that purpose (see s.  34 discussion). I do not believe that disclosure of alumni personal information by the ARP to a commercial organization for the marketing of products or services to alumni is disclosure for a purpose consistent with the original purpose for which this information was collected.

Section 33 allows for the disclosure of personal information for a different purpose if the individual the information is about consents to the disclosure. None of the universities has provided any documentation that includes an appropriate consent concerning disclosure of alumni personal information to companies involved in marketing their products or service, although, as mentioned earlier, the universities and alumni associations no longer disclose alumni personal information to these companies.

Finally, I do not see how any of the other provisions in s. 33 would allow for the disclosure of alumni personal information by the university to other organizations or companies, other than the alumni association, for the marketing of products or services to alumni.

Definition of Consistent Purposes

• has a reasonable and direct connection to that original purpose, and

• is necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body that uses or discloses the information.
  

6.0 CONCLUSIONS

The Act does allow for the collection of personal information if "that information relates directly to and is necessary for an operating program or activity of the public body." I believe that ARPs are established university programs created to foster a long-term relationship between the university and its alumni. The ARP needs to contact alumni from time to time about university programs and initiatives, including requests for alumni to donate funds to the university. Therefore, it is necessary for the ARP to collect sufficient alumni personal information to notify alumni of university-related matters.

It has also been an established practice for the university registrars or ARPs to collect the personal information that is used to register an individual with the alumni association and then for the association to provide the individual with information about university and association issues and initiatives. There is no legislation that expressly authorizes this collection on behalf of an alumni association. Also, the associations are not operating programs or activities of the universities. It must be noted, however, that the university ARP and its alumni association work closely together to achieve ARP and other university goals. Therefore, I believe that s. 26(c) allows the university to collect a limited amount of student personal information that will be disclosed to the alumni association where the association will use this information to register graduates as members and to contact alumni concerning university-related and alumni association issues and initiatives.

6.2 Notification of Purposes For Collection - At the time of collection, the public body must tell the individual from whom it collects the personal information about all of the intended purposes or uses for collecting the information. The universities' application to graduate forms include an appropriate notification that the personal information is collected for reasons related to graduation and to enroll the individual as a member of convocation.

However, in my opinion, the current forms do not include sufficient information for an individual to understand that the personal information will be used by ARPs to create the alumni list or to contact alumni concerning university programs or services, including university or alumni association fund-raising initiatives. As well, there is insufficient information confirming the disclosure of this personal information to the alumni association to register the individual as a member and to allow the association to contact alumni about university and association programs and initiatives, including marketing products or services to alumni. Information about these purposes should be included in the forms.

6.3 Uses of Personal Information - The university may use personal information for other purposes only if the new purposes are designed to carry out the original purposes or are consistent with the purpose for collecting the personal information in the first place or where the individual consents to the different use of his or her personal information.

Personal information is collected in the application to graduate form so the university can complete activities related to the student's graduation and enroll the student as a member of convocation.

As noted earlier, the university's use of personal information to distribute information to large numbers of students or alumni, through mailing houses, is a consistent use of this information. The agreements between the universities and the mailing houses include privacy sensitive provisions.

Again, I believe that the ARP's use of the student's personal information to create the alumni database and then to notify alumni of university programs or initiatives is a use for the purpose for which the information was originally collected. However, as mentioned above, these purposes should be clearly identified at the time the personal information is collected.

6.4 Disclosure of Personal Information - Regarding the universities' disclosure of alumni personal information, the established practice has been for the ARPs to disclose this personal information to the association to register individuals with the association and to allow the association to communicate with its members concerning university and association initiatives, including fund-raising and marketing products and services. In my opinion, disclosure of this personal information is consistent with the purpose for which it was originally collected.

In the past, ARPs have also disclosed the alumni personal information directly to the companies, or indirectly via the associations, for the purpose of sending alumni promotional material concerning products or services. This disclosure ordinarily was part of a written agreement between the alumni association and a particular company, and the agreement included obligations for both parties to protect the alumni personal information. In my opinion, however, the ARP's disclosure of alumni personal information to a company for its own marketing purposes is not consistent with the purpose for which this information was collected in the first place and should not occur.

7.0 RECOMMENDATIONS

1. University alumni relations programs collect or compile students' personal information to create the alumni database and then use this personal information to notify alumni of university programs or initiatives, including fund-raising drives. Also, the ARP discloses the alumni personal information to the alumni association, which then uses this information to register individuals as members and to communicate with alumni concerning university and association initiatives, including marketing products or services to alumni. At present, there is no clear notification of these purposes. Therefore, I recommend that, before a student's personal information is collected or compiled for these purposes, an appropriate notification be included in the application to graduate form.

2. The universities should, on a regular basis, send a reminder to alumni to allow them an opportunity to notify the university that they no longer wish to have their personal information used or disclosed for specific purposes, including the preparation of mailing lists used by the university or the association for marketing products or services to alumni.

3. A university and its alumni association should enter into a written agreement (or make necessary changes to any existing agreement between them) that establishes acceptable practices concerning the collection, use and disclosure of alumni personal information by the alumni association. These agreements should include the following privacy-sensitive provisions:

• the parties accept that the Freedom of Information and Protection of Privacy Act, Part 3, applies to the agreement,

• the alumni database or list is in the custody and under the control of the university,

• the alumni personal information is to be used by the association only for specific, university-related and alumni association purposes,

• the association is not to disclose personal information in the alumni database or list other than to the university and

• the association must protect the personal information in the alumni database or list by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.

October 24, 2000

Mark Grady
Portfolio Officer
Office of the Information and Privacy
   Commissioner for British Columbia

Investigation Report 00-01 October 25, 2000
Information and Privacy Commissioner of British Columbia