Consent
Personal Information collected by the University is confidential. It may only be used for the purpose it was provided for and in accordance with the consent obtained.
Why consent is necessary
When Concordia collects Personal Information, the individual is informed, through a Privacy Notice or by other means, of the purposes the information is collected for and the consequences of refusing to provide the information. Any other use of the Personal Information collected must be explicitly consented to by the individual.
For consent to be valid it must be:
- Clear, free and informed;
- Given for specific named and described purposes;
- Given for a set period of time;
- Communicated in clear and simple language;
- Requested on a document separate from any other written information given to the person concerned.
Sensitive Personal Information is information of a highly personal or intimate nature that requires a higher level of confidentiality. Examples include medical information, financial information, and biometric data (like fingerprints). Explicit consent is always required to share sensitive Personal Information.
Collection of Personal Information from the participants of research projects must be approved by the University Human Research Ethics Committee. Documentation and guidelines are available for the process of obtaining informed consent from participants.
Exceptions
In certain instances, the law allows Concordia to use or communicate Personal Information without specific consent. These include circumstances in which the use of the Personal Information is compatible with the purposes it was collected for, and when its use is clearly for the benefit of the person concerned.
Exception for study, research or the production of statistics
One of the exceptions in the Act respecting Access to documents held by public bodies and the Protection of personal information, chapter A-2.1 allows researchers to request Personal Information held by the University for the purposes of study, research or the production of statistics.
To submit a request to Concordia for the use or release of Personal Information for study, research or statistical purposes, please contact the Privacy Office at privacy.office@concordia.ca.
Steps:
External researchers
- An external researcher must make a formal written request to the Privacy Office to access Personal Information. They must enclose a detailed presentation of the research activities, state the grounds supporting its release, mention all the persons and bodies to whom they are making a similar request, describe the technologies that will be used to process the information, and submit the documented decision of a research ethics committee if applicable.
- The University’s Privacy Office will conduct a Privacy Impact Assessment (PIA). It will consider, among other criteria, whether or not the purpose of the study or research can be achieved if the information is provided in a form that does not identify the individuals concerned and whether or not it would be unreasonable to obtain the concerned individuals’ consent.
- If the PIA concludes that Personal Information can be released to the researcher, a written agreement must be made between the researcher and the University. This agreement is provided to the Commission d’accès à l’information du Québec.
Internal researchers
- An internal researcher must make a formal written request to access Personal Information. A form to request Secondary Use of Data is available.
- The information must be de-identified, meaning it no longer allows the person concerned to be directly identified.
