The following activities have been identified as being, or potentially being, commercial in character and involving, or potentially involving, the collection, use or disclosure of personal information.
 
1. Affinity Services
External Relations has relationships with one company which offers life insurance, and one which offers home and auto insurance. No personal information is provided to these companies. However, names and addresses are provided to third-parties which mail to members of the alumni materials from these insurers. Opt-out cards are always included with any materials mailed. Furthermore, if a member of the alumni inform the University that they do not wish to receive such mailings their names and addresses are not provided. We have a contract with one of the third parties restricting their use of the information to the University mailings. A contract will be signed with the other third-party in the near future. There are no PIPEDA issues in respect of these activities.
 
2. Archives
The operation of the University's Archives is not a commercial activity, although the Archives may be the repository of personal information that was collected for commercial purposes. However, PIPEDA has an exception that permits archives to hold such information and therefore PIPEDA does not have implications for the Archives.

3. Art Gallery
The Gallery has an annual fundraising project which involves the auction of donated works of art. It also sells exhibition catalogues at or below cost. Payments are made by cash or cheque. No personal information is collected other than the personal information that appears on cheques used to make payments. None of this information is retained by the University.
 
4. Banks
Student Services submits personal information to banks for the purposes of student loans. However, this is only done at the student's request so that, even if this is a commercial activity, PIPEDA is not an issue.
 
5. Bookstore, Fine Arts Store and Departmental Support Services
With the exceptions of a) a small number of personal orders (1 per cent of bookstore sales) through the bookstore and of b) personal printing, copying, finishing and courier services (20 per cent of Departmental Support Services sales) provided to individuals, these operations deal only with course-related materials and normal University business. Therefore, only the two listed exceptions could be covered by PIPEDA, and in each case consent can be implied to the collection of personal information. Furthermore, a) no personal information is collected when cash or debit payments are made; b) no personal information appearing on cheques is retained once the cheques are deposited once per month in the case of the Fine Arts store and once per day in other cases; and c) personal information on credit card impressions or slips is not used for any other purpose, is retained in locked filing cabinets and is destroyed after seven years.

6. Collection Agencies
Financial Services provides personal information to collection agencies. However, section 7(3)((b) permits the disclosure of personal information without the knowledge or consent of the individual if the disclosure is for the purpose of collecting a debt owed by the individual to an organization.

7. Community Services
External Relations hosts 30 to 40 events each year which provide services, such as meals or greens fees, in return for a participation fee intended to cover only the costs of providing the services. These events are probably commercial activities. The University uses its alumni and donor databases to mail invitations, and honours any requests from individuals who do not wish to receive such invitations. The only personal information that is collected in the course of such activities would be information provided as a result of payments by credit card. Such information is not used for any other purpose, is retained in a locked cabinet for seven years and is then destroyed. There are no PIPEDA issues in respect of these activities.
 
8. Computing Services
Printer credits are sold. No personal information is collected.

9. Conferences
Conferences provides services to external groups and individuals for the purpose of making a profit. Therefore, PIPEDA probably applies to these conference activities. Personal information collected could include a person's name, address, phone number, gender, age, food preferences, health issues, and activity preferences. This information is not used for any purpose other than to provide the services that resulted in the collection of the information, is maintained in locked filing cabinets, and is destroyed after seven years.
 
10. Employee Benefit Providers
With two exceptions, any personal information provided to the University's employee benefit providers is provided on application forms that employees complete and sign for the purposes of applying either for the benefit coverage or for benefits under that coverage. If consent is required for the University to provide that information to the benefit providers, consent is implied.

The two exceptions concern personal information that the University provides to its life insurance provider for the purposes of premium renewals and to its long term disability insurance provider for the purpose of processing claims for disability benefits. In each case, consent can be reasonably implied. However, the University will ensure that these insurers have policies and practices in place so that they a) do not use any personal information provided by the University in any other commercial activity, b) protect that information from disclosure to other parties, c) do not retain the personal information longer than necessary, and d) discard the information in an appropriate manner once the information is no long required.
 
11. Food Services
Food services are provided to students who live in residences and PIPEDA does not apply. However, since the food service provider is a commercial organization, the transfer of personal information to the food service provider may be covered by PIPEDA. As a result, the only information that is transferred is the student's name, student identification number and residence room number.
 
12. Governments
It is unlikely that the University would disclose to a government any personal information collected by the University in the course of a commercial activity, or disclose to a government any personal information as part of a commercial activity. Even if such a disclosure were to occur, PIPEDA permits the disclosure without the knowledge or consent of the individual a) if the disclosure is made in response to a request for the information that identifies the authority to obtain the information and indicates that the disclosure is requested for the purpose of administering any law or b) if the disclosure is required by a person with jurisdiction to compel the disclosure or c) if the disclosure is required by law. The University is not aware of any disclosures that would be made to governments that would not fit under one of these three categories.

13. Lawyers
The University may at times disclose personal information to its lawyers. However, PIPEDA permits such disclosures without the knowledge or consent of the individual.

14. Library
The Library sells printer credits and photocopy cards. No personal information is retained.
 
15. Payroll & Pensions
Since the University uses external and commercial payroll and pension service providers, the provision of personal information to those providers for the purposes of providing services to the University is not a disclosure of personal information in the course of a commercial activity. However, if a service provider were to use that information in the course of its own commercial activities, that use could be covered by PIPEDA. Therefore, the University will ensure that these service providers have policies and practices in place so that they a) do not use in any commercial activity personal information provided by the University, b) protect that information from disclosure to other parties, c) do not retain the personal information after it is no longer necessary to provide services to the University, and d) discard the information in an appropriate manner once the information is no longer required.
 
16. Physical Recreation and Athletics
Memberships, classes and facilities rentals are offered to the public at a charge. These activities may be covered by PIPEDA. The Department in some cases collects names, addresses, phone numbers or e-mail addresses. There are no payments made by credit card. Copies of cheques are not retained when payments are made by cheque. The personal information is stored in locked cabinets, or on computers that are password protected, and in offices that are not open to the public.
 
17. Research
If research involves the collection, use or disclosure of personal information, and if the research has a commercial character, PIPEDA may apply to that research. For the research to have a commercial character it would have to have a stronger connection to commerce than to the research and educational mandate of the University. It is likely that the required connection would be present if the research were undertaken in conjunction with commercial partners or with a view to the commercialization of the products. The University is not aware of any such research. If such research were to be conducted in the future, the approval of the Research Ethics Board would be required and that Board would be responsible for ensuring that the requirements of PIPEDA were met.

18. Residences
Mount Allison's residences are provided only to permit students to attend the University and to offer the students a learning experience, and are important to our efforts to educate the whole person. Therefore, the operation of the residences for students is not a commercial activity and PIPEDA does not apply. No personal information concerning residence students is provided to any third parties.

19. Service Clubs
The University has in the past provided personal information to local service clubs to permit them to market goods or services for valuable consideration as part of fundraising efforts. Given that the provision of these goods or services for valuable consideration constitutes a commercial activity, the University will not provide such information in the future.

20. Student Organizations
The only personal information that is transferred to such organizations are a) a list of student names and the Student Union membership fees that they have paid, which list is provided to the Students' Union and b) mailing labels that are provided to the Students' Union that are used for the purpose of mailing yearbooks to former students. PIPEDA has no application to the first transfer and probably has no application to the second transfer. However, in the case of the second transfer steps will be taken to ensure that copies of the labels are not retained and that the labels are not used for any purpose other than the purpose for which the labels are produced.

Requests from student organizations for other personal information will be assessed on an individual basis and steps will be taken to ensure that the information is not used for a commercial purpose by the organization making the request or by a third party.

21. Student Services
Students pay for transcripts and diplomas. No personal information is collected.
 
22. Summer Camps and Other Activities Offered to the Public Other than Conferences
A list of names may be prepared to identify those who may attend such activities. Additional personal information may be collected if room and board is provided. However, room and board services are offered through Conferences and therefore the Conferences section of this appendix covers the PIPEDA issues that might be associated with such activities.
 
23. Windsor Theatre/Performing Arts
Tickets to performances and, in the case of Performing Arts, series subscriptions are sold to individuals. Payments are made by cash and cheque. No personal information contained on cheques is retained. The only personal information retained is the list of subscribers.