Privacy information basics

If you plan only to collect the information (for example, in a survey) and there is no need for individuals to identify themselves, then this may not be considered "personal information" under privacy legislation. However, if the information can be linked to individuals' contact information or if their responses could reveal their identity, then treat it as personal information.

If you intend to collect personal information directly from research participants, you must be provided with appropriate notification of the intended use of their information for the research before they give their informed consent. If instead the information is obtained from a public body or private sector organization, the you must speak with the organization about completing a research agreement as required in the applicable privacy legislation. The agreement will confirm the steps you must take to protect the personal information while it is under your control.

A research participant must be notified before they give their consent if his or her personal information gathered during the research will be linked with other information about the participant that is contained in public or personal records. As well, the participant must be notified in advance of consent of any known uses of his or her information. Should you choose to use the personal information for other purposes, you must first contact the participants to obtain their permission for the new use.

Best practices for the use of personal information in research include:

• Notification in writing:
  • Identify all uses or purposes for subjects' information.
  • Confirm and describe how you will keep the information secure against risks such as improper access or disclosure.
  • Provide your contact information so that subjects can easily ask questions about your research.
  • Obtain the research subject's informed, written consent.
• Limit Collection:
  • Collect only the information you need.
  • Turn off the recorder or put down the pen when all questions have been answered.
  • Limit the collection subjects' contact information to what is necessary.
• Limit Use, Disclosure and Retention:
  • Use the information for only the intended purposes.
  • Share the information only with others involved in the research.
  • Minimize the time you retain the information in identifiable form and follow the research ethics policy for retention and destruction of personal information.
• Use Appropriate Safeguards:
  • The more sensitive the information, the higher the required security measures to protect the information against risks such as unauthorized collection, access, use, disclosure or disposal.
  • At home or elsewhere, keep paper records in locked storage when not in use.
  • Use passwords and encryption for protecting electronic records in all computers and other storage devices such as memory sticks.
  • When travelling, do not leave laptops and other portable devices unattended.
  • It is best not to store research subjects' personal information on hard drives.
  • If you will use online survey tools or tele/video conferencing services based outside Canada, you must notify participants in advance that these services may not meet Canadian standards for protecting personal information against risks such as inappropriate use or disclosure to third parties.