fb pixel

Creating a Privacy Notice

Creating a Privacy Notice for the Collection of Personal Information

Subsection 37(2) of FIPPA requires that individuals be informed, at the time that their personal information is collected, of the following:

  • the purpose for which the information is collected
  • the legal authority for the collection; and
  • the title, business address and telephone number of an officer or employee of the public body who can answer the individual's questions about the collection.

This is called a "privacy notice" or a "notice of collection statement". There is no set form for how this information must be provided to the individual. What is important is that the information provided is clear and complete, so that the individual understands why University is collecting the information, as well as how it will used and, if applicable, disclosed.

To the first bullet, when describing the purpose for which the information is being collected, include sufficient information regarding UWinnipeg's plans for its use and, if any, disclosure. The amount of detail that is appropriate will depend on the situation and the sensitivity of the information being collected. In the case of certain straight-forward purposes that involve the collection of routine, less sensitive personal information, providing the purpose alone may be sufficient, in that the individual to whom the information relates would reasonably understand that a certain use of their information is implied. But when in doubt, always provide additional information so that the individual fully understands how the University plans to use and, if applicable, disclose the personal information collected.

To the second bullet, subsection 36(1) of FIPPA sets out the circumstances in which the University has the authority to collect personal information. The University may collect personal information under:

  • 36(1)(a) - collection of the information is authorized by or under an enactment of Manitoba or of Canada,
  • 36(1)(b) - the information relates directly to and is necessary for an existing service, program or activity of the University, or
  • 36(1)(c) - the information is collected for law enforcement purposes or crime prevention.

The University's governing legislation, the University of Winnipeg Act, sets out the purposes and objects of UWinnipeg. Personal information that is collected by or under the Act is authorized under 36(1)(a) of FIPPA. Other Manitoban or Canadian legislation may also obligate or permit the University to collect personal information. Personal information that is not collected by or under a specific law is typically collected under 36(1)(b) of FIPPA. In creating a privacy notice, citing 36(1)(b) is the simplest way to satisfy the required notice of legal authority. Citing 36(1)(b) is also a good reminder that personal information should be collected only when necessary and limited to the least amount of information necessary to carry out the service, program or activity for which it is collected.

To the third bullet, the faculty, institute, centre, department or other business unit that is collecting the personal information must include the title, business address and telephone number of one of its employees who can answer questions about the collection. Or it may provide the contact information of the Executive Director, Data Privacy and Compliance. 

For example privacy notices, scroll to the bottom of this page.


Creating a Privacy Notice for the Collection of Personal Health Information

Subsection 15(a) of PHIA requires that individuals be informed, at the time that their personal health information is collected, of the following:

  • the purpose for which the information is collected; and
  • the title, business address and telephone number of an officer or employee of the public body who can answer the individual's questions about the collection.

This is called a "notice of collection statement", or often a "privacy notice". There is no set form for how this information must be provided to the individual. What is important is that the information provided is clear and complete, so that the individual understands why University is collecting the personal health information, as well as how it will used and, if applicable, disclosed.

To the first bullet, when describing the purpose for which the information is being collected, include sufficient information regarding UWinnipeg's plans for its use and, if any, disclosure. The amount of detail that is appropriate will depend on the situation and the sensitivity of the information being collected. Always provide enough information so that the individual fully understands how the University plans to use and, if applicable, disclose the personal health information collected.

To the second bullet, the faculty, institute, centre, department or other business unit that is collecting the personal information must include the title, business address and telephone number of one of its employees who can answer questions about the collection. Or it may provide the contact information of the Executive Director, Data Privacy and Compliance.

For example privacy notices, see below.


Example Privacy Notices

  1. The personal information on this form is collected to register you for our upcoming conference. It will be used to maintain a list of registrants and also to contact you with updates to the conference agenda. It is collected under 36(1)(b) of the Freedom of Information and Protection of Privacy Act. Questions regarding this collection can be directed to the Executive Director, Data Privacy and Compliance, 515 Portage Avenue, Winnipeg, MB R3B 2E9 or 204.988.7538.
  2. Personal health information on this intake form is collected to process your request for therapy and to assist your therapist's work with you. It will be used by your therapist to provide you with therapy and may also be used for administrative functions related to the provision of therapy. Questions regarding this collection can be directed to the Executive Director, Data Privacy and Compliance, 515 Portage Avenue, Winnipeg, MB R3B 2E9 or 204.988.7538.
  3. Any personal information provided on this survey is collected under the authority of 36(1)(b) of the Freedom of Information and Protection of Privacy Act. It is collected to administer the survey. Questions regarding this collection can be directed to the Executive Director, Data Privacy and Compliance, 515 Portage Avenue, Winnipeg, MB R3B 2E9 or 204.988.7538.
  4. The collection of personal information through this application is for the purpose of processing your reservation, and will be used as outlined in the attached reservation agreement. It is collected under 36(1)(b) of the Freedom of Information and Protection of Privacy Act. If you have any questions regarding the collection of your information, contact the Executive Director, Data Privacy and Compliance at 204.988.7538 or 515 Portage Avenue, Winnipeg, MB R3B 2E9.