Skip to navigation content (Press Enter).

McMaster University

Person sitting in entrance at University Hall

Frequently Asked Questions (FAQs)

Link to PDF of all FAQs PDF

STUDENTS & ALUMNI INFORMATION

1. Students often ask for a copy of documents they submitted in support of their application. This could be transcripts, medical information or reference letters. Does the University have to provide such information?

Yes, students have a right of access to their own information, even if they initially supplied it. Care must be taken to ensure that other information in the student file, such as confidential letters of reference, are not released in error.

2. Students authorise the University to release a transcript to a sponsor.  Can the University release the whole record?

The University may only release the specific information for which the student has given written consent.

3. How should a University deal with telephone inquiries from students for information about their own record?

The University must first be satisfied that the person calling is the person the information is about. This can be done through questions based on information in the student file that would not likely be known by others such as student number, courses taken, name of professor, etc. Asking for the student's address or even phone number would not be sufficient to confirm identity since this information may be commonly known by others.

4. Can the University provide students with identification cards that include photographs and other personal information?

Yes, the student has custody of the information on the identification card and can control access to it. Students should not be required to relinquish their identification card to access University facilities or services except for the purposes of protecting the student’s personal information.

5. Can high school counselors request information on the status of a student's application for admission?

The information may only be provided if the student has given written consent.  It would be preferable for the student to share such information directly.

6. Can a high school be provided with the names of students who have been admitted to the University?

The University may not release this information without the written consent of the students. The Ontario Universities Application Centre may collect this written consent as part of the application process and may be in a position to release such information.

7. Can the University release a student's timetable?

No, the student timetable may contain personal information, such as the student number and courses taken. Absent the permission of the student, this information can only be released in exceptional circumstances, such as an emergency.

8. Can the University release information on former students/graduates?

As of June 10, 2006, an institution may disclose personal information in its alumni records for the purposes of its own fundraising activities if the institution and individual receiving the information enter into a signed agreement and the personal information is reasonably necessary for the funding activities. The receiving party must agree in writing to comply with the requirement to give initial and periodic notice regarding an individual’s right to request fundraising cease, to grant the individual to whom the information relates access to the information if requested and to cease using the personal information if requested by the individual to whom it relates. Please note that the University’s general collection and use notice provides that the University has made some of this information a public record and may release same.

9. Can the University release student information to a collection agency when a student has outstanding accounts?

Yes, but the information released should be restricted to that required by the collection agency to carry out its function. FIPPA s.42 (g)(aiding an investigation) permits disclosure to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result.

10. Can the University share information about students with the MSU, MAPS or the GSA?

Yes. When students first register at McMaster they are informed through the general collective notice that certain personal information will be shared with the relevant student group and are asked to agree to this disclosure.

11. Can the University disclose student phone numbers to third parties (people or organizations outside the University)?

No, unless the reason for the disclosure is covered under one of the exceptional circumstances outlined in FIPPA s. 42(permitted disclosure).

12. Can faculty and staff who have told students in the past that they would provide references continue to do so without formal consent from the student?

No. In the absence of an exceptional circumstance, formal consent is required for the disclosure of personal information to a third party. The third party requesting the reference should obtain the consent.

13. Can staff and faculty of the University provide information about students to potential employers for reference purposes?

Anyone providing a reference must ensure that the student has given written consent for the disclosure of personal information.

14. Can a professional body, foreign government, or Co-op placement force their clients to sign a blanket release so that they can have access to University records on students they sponsor at the University?

Where such an entity is providing any sort of benefit to its client pursuant to an agreement, there is generally nothing to prevent it from making the continued provision of such benefits conditional upon the individual consenting to access of such personal information pursuant to s.21(1)(a)(consent of individual to whom information relates).

15. Faculty members often retain files on graduate students they have supervised. Can a student request to see the content of the file?

Yes, an individual can request to see information the University has on file about him or her because such a file is considered a record under the control and custody of the University. However, some material that was supplied in confidence may be severed before disclosure.

16. Are personal notes, made by staff or faculty during an interview with a student, accessible to the student?

Yes. Any information about a student is that individual's personal information and, therefore, potentially accessible under the Act. There may be occasions when this type of information may not be or should not be disclosed:

  • if the release could be harmful to someone's health or safety;
  • if the release could be harmful to an investigation in a law enforcement matter;
  • if the information could be construed as advice to a University official;
  • if the notes contain information about a third party (this information would have to be severed).
17. Can students be asked to read work aloud in class?

Yes, this would not be an invasion of privacy.

18. Can students mark each other's work?

Normal group learning can still take place.  A student acting as a Teaching Assistant would be bound by the protection of privacy requirements of FIPPA.

19. How can marked work be returned to students? Can it be left in a box in the hallway, or in the classroom so that students can retrieve it themselves?

No, marked work cannot be left unattended for student pick up. Every effort must be made to protect the privacy of the students. Tests and assignments should be returned directly to the students. Students should not be given access to the academic work of others, except in specific group learning situations that are part of a course.

20. How long are instructors required to keep papers, assignments, and tests that students have not picked up?

According to current University regulations, instructors are responsible for ensuring that all graded material not meant to be returned to students, and the instructor's record of how the final grades in a course were determined, are accessible to the Department Chair for a period of seven months following the end of the academic year in which the course was offered (i.e., March 31 of the following winter session).

Under FIPPA, personal information must be retained for a minimum of one year after its last use. Material that was intended to be returned to students but not picked up would, therefore, need to be kept for one year from its last use by the instructor. (This period can be shortened, but only with the consent of the individual to whom the information relates.)

21. If written final examinations need to be retained for one year after they are written, does this mean that students may appeal their final grades up to one year after the examination is written?

No. The FIPPA requirement to retain final examinations for one year is intended to allow an individual to examine this record and review the information used to make a decision about him or her. It does not affect the University's policy on appeal of grades which is clearly outlined in the Student Appeal Procedures.

22. What limitations are there on access to student records by faculty or staff?

Staff should only have access to information that they require to perform their stated duties as an employee of the University. For example, staff may access information for the purposes of academic planning, student advising, and other legitimate academic reasons which are deemed to be in the best interest of the student and the academic programs of the University.

23. What information/records can be withheld because a student owes the University money? Can the Registrar refuse to release an official transcript or diploma for a student who owes money to the University?

Yes. However, if there is a formal FIPPA request, the University cannot withhold personal information from the student based on money owed to the University however the form of that record need not be an official transcript. The Act provides an applicant with a right of access to any record in the custody or under the control of the University, including a record containing personal information about the applicant. In this case, the University is required to provide a statement of grades to the student. It can refuse to issue an official transcript or diploma unless the student settles the outstanding account.

24. Can a university continue to publish lists of graduates?

The McMaster University Statement on the Collection of Personal Information and Protection of Privacy states “The names of alumni, their Faculty and program, award information, degree(s) awarded and date of graduation is considered public information and may be published by McMaster University.”

25. Could you please tell me whether this ban prohibits us from putting graduate student email addresses on our departmental webpage? This is quite a common practice, and this contact information is often useful for students looking to contact Teaching Assistants and for students from other universities looking for information from current grad students about our graduate program.

If the new guidelines do prohibit us from putting email contacts on our webpage, can this be overcome if we ask for permission from each student? Any advice is appreciated.

btaining consent from the students to disclose their email addresses is one option, but if the personal information was collected for the purpose of posting it on the webpage, no consent is required as the exception in section 42(1)(c)(purpose for which information was obtained) applies.

26. How should we have students verify their identity when they contact us by phone or e-mail?

Students should be asked to provide a piece of confidential information to which the University already has access (such as a student number, home address or telephone number) so that the University can confirm the identity of the student. This is consistent with the security and protection obligations under FIPPA.

27. Are we able to post information such as a comprehensive list of those students who were named to the Deans' Honour List for a particular session?

Disclosure of such personal information would be inappropriate without the prior consent of the individual to whom the information relates. Providing for such disclosure in a general notice prior to enrolment will suffice to permit such disclosure. This has been done.

28. Obviously, I need to have a written note on hand from a student before writing any letter of reference or answering any questions from prospective employers or schools.

  1. Is there a suggested wording for this letter of permission?
  2. In my letter of reference, may I invite the addressee to call with further questions?
  3. If the addressee of a reference letter calls with further questions, may I still share information under the original agreement with the student?
  4. Same as #3, but what if someone else from the same organization calls?
  5. Actual case (but pre-FIPPA!): a prospective employer calls me, wanting to know how this student would fare working in a foreign environment. I happen to know that the student grew up in another country/culture and therefore would do well. Am I allowed to divulge this information as evidence in the student's favour?
  1. Is there a suggested wording for this letter of permission?


    Any generic wording will suffice so long as it states that you are permitted to disclose such personal information to a third party for the purposes of providing a reference.

  2. In my letter of reference, may I invite the addressee to call with further questions?

    While a generally worded consent would likely suffice, it is advisable for the consent to include a provision stating that you may invite the addressee to contact you with further questions.

  3. If the addressee of a reference letter calls with further questions, may I still share information under the original agreement with the student?

    While a generally worded consent would likely suffice, it is advisable for the consent to include a provision stating that you may answer further questions posed by addressee in addition to disclosing personal information in the letter of reference.

  4. Same as #3, but what if someone else from the same organization calls?

    The consent should state that the personal information may be disclosed to the addressee or any associate, co-worker or agent of the addressee. More importantly, and in connection with all of these types of reference letters, when the student requests it be sent, request that the student write to you requesting the reference letter and acknowledging the release of your opinion both in the reference letter and subsequent communications and correspondence.

  5. Actual case (but pre-FIPPA!): a prospective employer calls me, wanting to know how this student would fare working in a foreign environment. I happen to know that the student grew up in another country/culture and therefore would do well. Am I allowed to divulge this information as evidence in the student's favour?

    You may not divulge such personal information without the consent of the person to whom the information relates. Ask the caller if a consent was obtained. When receiving C.V.’s with references ensure a consent to call and obtain personal information is also provided.

29. For purposes of our Faculty Awards Assembly, we compile a booklet listing all of the award winners for scholarships, etc. Is this no longer appropriate?

Disclosure of such personal information would be inappropriate without the prior consent of the individual to whom the information relates. Providing for such disclosure in a general notice prior to enrolment will suffice to permit such disclosure. This has been completed.

30. Can we confirm if a person is here or is a graduate/former student within the department for employment reference purposes etc.?

References may not be provided without the prior consent of the individual to whom the information relates. A disclosure has been made in the general collection and use notice that general alumni information may be released.

31. Can announcements about thesis/project defenses be posted on hallway bulletin boards, department websites, emailed to the faculty and other graduate students within the department?

Disclosure of such personal information would be inappropriate without the prior consent of the individual to whom the information relates.  However, in the context this does represent a disclosure for learning and educational purposes.

32. Can professors assign students to groups and give the group members each other's names?

Yes, professors may do this.

33. Can students within the department have access to our group email address (McMaster electronic distribution list) for all students? i.e. Dept. Graduate Student Representative wants to send out an email to all Civil Eng. Graduate students about a meeting/event that is going on, can the rep have the group email address?

Generally, such personal information may be disclosed in such circumstances, so long as this was one of the purposes for which the information was obtained or compiled. This has been disclosed in the University’s general collection and use notice.

34. Can names of graduate students be placed on mailboxes that are in an area accessible to the public during working hours?

Yes,  such  information  may  be  disclosed  in  this  manner  pursuant  to  section 42(1)(c)(purpose for which information was obtained).

35. If a student wins an award, can a congratulations notice be placed on a bulletin board or displayed on a website?

Disclosure of such personal information is inappropriate without the prior consent of the individual to whom the information relates. However, such disclosure and use has been described in the University’s general collection and use notice.

36. A student needs to contact a Department Student Club representative, can we provide contact information?

Yes, so long as the person to whom the information relates was given notice that the contact information could be used for such a purpose.

37. Family Emergencies – if someone calls or comes into the office indicating that he/she is a family friend or is a family member of student X and they need to get in touch with them due to emergencies ~ what are we to do? Can we confirm that the person is or is not a student and try to reach them and have them call home or do we have to respond that we cannot confirm that they are a student in our program? What if it is a police officer with appropriate identification?

Such personal information may be disclosed if the institution reasonably believes that the health or safety of an individual is at risk (section 42(1)(i)) or under compassionate circumstances (section 42(1)(j)). If the requester is a  police officer, it may be disclosed under the law enforcement exemption as well.

38. Our Student Appeal Procedures and other Hearings Committees indicate that unless someone requests a closed hearing, all such hearings are open. Can we continue to do this or does this violate FIPPA?

Yes, most policies require the tribunal to declare the hearing open or closed at the outset. Therefore, there is an implicit consent to disclosure where an open hearing is commenced. However, if the hearing includes the disclosure of personal information of another party or disclosure of personal information which the person to whom it relates is not entitled to access, then the hearing may have to be closed.

39. Can departments continue to display informal photos of students in offices, hallways and on websites? What about 'where are they now' information (that is not Alumni Association information)?

Photos may be displayed so long as the person in the photo was notified of the purpose of the photo at the time it was taken. Such disclosure and use has been described in the University’s general collection and use notice.

40. I frequently receive faxes from institutions requesting verification of MBA degrees. These requests are always accompanied by a signed release form. Under FIPPA, should I continue to provide these verifications as long as I have a signed release form from the student?

Where a student has consented to such disclosure, the personal information may be disclosed pursuant to section 42(b)(consent to disclosure). The University’s present collection and use notice provides for this.

41. We provide MBA students with letters for various reasons. Occasionally a student will ask if a friend/family member can pick the letter up from our office on their behalf. We have always received either a phone call or an email from the student verifying that this is permissible. Is this still the case under FIPPA?

So long as you can reasonably confirm that the student was the person emailing or phoning with consent, it is permissible for a friend/family member to pick up the document pursuant to section 42(b)(consent to disclosure).

42. If an agency calls to verify information on a student such as did they graduate? Did they complete these courses? What can we answer?

Generally such information is not permitted to be disclosed because it is personal information. However, the general notice prepared by McMaster states that such information is collected as a public record and, therefore, disclosure of a student name, faculty/program and year of graduation shall be permissible.

43. CLASSLISTS: Some instructors who teach for us are outside consultants and at the beginning of class are given a classlist with student name, mailing address, home & business phone numbers and email address. On the classlist it is indicated only for instructor and "Do Not Circulate in class".

Such information may be disclosed to the instructor pursuant to section 42(c)(purpose for which information obtained), as the information is being disclosed in accordance with the purpose for which it was obtained or compiled.

44. CLASSLISTS: A second classlist is circulated with only the student's name (first & last name) and email address for students to check that they are on the classlist. If not on list they are to add their name.

Such a classlist must contain McMaster’s general FIPPA notice because personal information of students not on the list is being collected

45. If a student requests a mark over the phone, how should this be handled?

So long as the student’s identity can reasonably be verified and none of the exceptions in section 49 (non-disclosure of information to person to whom it relates) apply, such information may be disclosed.

46. Can we accept an email as written consent?

Written consent requires the hand written signature of the party granting consent. However, sections 21 (personal information exemption) and 42 (permitted disclosure of personal information) of the Act simply require “consent”, not “written consent”.

Generally, if one can reasonably conclude that the consent is being granted by the party to whom the information relates email consent is appropriate. It would be reasonable to make this conclusion if the email is a McMaster email address because such emails are assigned by the University and password protected so only the student or employee to whom the email is assigned may use it. However, if the email is from a non-McMaster email address, one cannot reasonably conclude that the party sending the email is in fact the party granting consent without further inquiry.

47. If a Third Party pays for the student's courses, can they request to know if the student is attending class and ask for their marks?

Regardless of who is paying for the course, such information is personal information and protected by FIPPA. Unless consent is obtained from the student, such information may not be disclosed.

48. Is a written request from a former student asking for a reference sufficient consent to disclose personal information?

Yes, so long as the University may verify that the student did in fact sign the written request. The student should also have specified to whom the personal information may be disclosed.

49. Can we ask students to identify themselves in a testing situation?
Yes, you may.
50. How long must an instructor or a department keep essay sign-up sheets or class lists? If written consent is obtained for the use of such lists, how long must consent be kept?

Generally, personal information must be kept for one year prior to being destroyed. It may be destroyed earlier with the consent of the parties to whom the information relates.

Where consent is given permitting use of the personal information, the consent should be kept for as long as the information is being used for the purpose identified in the consent.

51. There is one course that every graduate student must take. The School of Graduate Studies produces a list of students, visually verifies the student's identity and has the student sign the sheet. Does this present a problem under FIPPA? Do we have to take steps to prevent students from seeing the names and/or student numbers of other students on the list?

So long as proper notice is given at the time of collection stating that the personal information will be used for this purpose, this practice may continue. Obtaining consent from the students would a beneficial, but not a necessary safeguard.

52. Departments provide instructors with class lists – these lists are also shared with Teaching Assistants who are either graduate students or senior undergraduates. Can this practice continue? What safeguards must be in place?

So long as proper notice is given at the time of collection stating that the personal information will be used for this purpose, this practice may continue. Obtaining consent from the students would a beneficial, but not a necessary safeguard.

53. Often at the beginning of the year, lists are posted outside of departmental offices telling students (particularly those enrolled in evening classes) which tutorial session they should attend. Can this practice continue? What safeguards must be in place?

So long as proper notice is given at the time of collection stating that the personal information will be used for this purpose, this practice may continue. Obtaining consent from the students would a beneficial. The present collection notice attempts to deal with this issue.

54. Can we make public the names of winners of academic awards and prizes?

If notice is given to students stating that such information shall be considered public information.  The collection notice now deems that to be a public record.

55. Some research contracts that involve US companies request information (name, address, other info) about students who may be working on the research contract. Presumably, we need to get student consent before providing this information. Who should collect the consent, the Office of Research Contracts or the student's supervisor?

If notice is given to the students at the time of collection of the personal information stating that such information may be disclosed upon request to such companies, no consent is required. If such notice has not been given, consent must be obtained. Any of the parties noted may collect the consents and such consents should be filed and kept for as long as the personal information is to be used for this purpose.

56. What happens when research contracts involving entities inside Canada request information about the immigration/citizenship status of students working on the research?

In regards to FIPPA, such information is personal information and may not be disclosed without consent (unless another exception applies). However, depending on the circumstances, one must be mindful of the potential application of the Ontario Human Rights Code to such circumstances.

 

PLEASE NOTE: These Frequently Asked Questions are intended to provide general information only, not legal advice. Given the general nature of these questions, the materials herein cannot be entirely accurate, complete, reliable, or error-free in specific circumstances. Please refer specific questions in relation to your particular circumstances to the University Secretariat for specific responses.