22. Personal Information authorized for destruction must be safely and securely destroyed: a. Electronic records should be properly deleted/erased in accordance with the Electronic Media Disposal Standard (IT 9.65). b. Paper records containing Personal Information should be shredded in a cross shredder or placed in a secure shredding bin. 23. Employees will safeguard personal information and take all reasonable steps to protect this information by following all Lakeland College Policy & Procedures, in particular, but not limited to: Access to Information Procedure (Fin 4.03), Records Retention (Gen 8.73), Social Media Policy (Gen 8.89), Security of Student Information (STU 5.80), Information Technology Security Policy (IT 9.50), and Electronic Media Disposal Standard (IT 9.65). Privacy Breach 24. A privacy breach occurs when personal information is collected, retained, used or disclosed in ways that are contrary to the provisions in the FOIP Act. If a privacy breach occurs the Employee must immediately notify their direct supervisor and the FOIP Coordinator. Where the risk involves a breach of electronic data, the Director of Information and Technology should also be immediately notified. 25. The college will take the following steps to respond to a Privacy Breach: a. Contain and minimize the breach b. Evaluation of the impact of the breach, c. Notification of individuals if required, and d. Prevention to preclude occurrence of similar breaches in the future. 26. The FOIP Coordinator will notify the President and immediately conduct an internal investigation of any breaches assessed at a high risk. The FOIP Coordinator will assess whether notification to third parties and the Office of the Information and Privacy Commissioner is required. Training 27. The FOIP Coordinator will provide relevant FOIP training and support to employees.
Policy Acknowledgment 28. All Lakeland College employees must sign the Code of Conduct Acknowledgment Form (HR 2.04-1) confirming the Employee’s responsibility with respect to confidential information. 29. Each employee who has access in the course of their work to Personal Information shall be asked to sign an acknowledgment that they have read and understood this policy. Any questions about this policy can be directed to the FOIP Coordinator.
Page 5 of 6
