Information Governance

Advanced Analytics – Analytical methods that use artificial intelligence and other techniques to look ahead and identify what is probable or possible based on existing Data.

Artificial Intelligence (AI) – Technologies that simulate human reasoning, creativity, learning and decision-making to generate content, make predictions, or take action.  

Custody or Control – Any records or Data JIBC possesses, manages, or has the legal right and ability to access even if held by a third-party service provider.

Data – Collection of ordered symbols such as letters or numbers that convey factual, statistical, qualitative, or quantitative information.

Data Governance – System of quality control that adds rigour and discipline to the process of managing, using, improving, and protecting organizational Data.

First Nations Principles of Ownership, Control, Access, and Possession (OCAP) – Establish that First Nations alone have control over Data collection processes in their communities, and that they own and control how this information can be stored, interpreted, used, or shared.

Information – Any collection of Data that is processed, analyzed, interpreted, classified, recorded, or communicated to serve a useful purpose, present fact, or represent knowledge in any medium of form.

Information Classification – Activity of reviewing and applying a classification based on the sensitivity of the Data itself to aid in proper Data management and use.

Information Schedules – Timetable that governs the lifecycle of information to ensure records are kept for as long as required, are preserved if they have enduring value, and are routinely destroyed when they are no longer needed. Also known as Records retention and disposition schedules.

JIBC Community – All Institute employees, students, Board members, and any other person who is contractually obligated to comply with this Policy.

Lifecycle – The lifespan of information from its creation or receipt and use to its final disposition such as destruction or transfer to the B.C. Archives.

Metadata – a set of structured Data that describes and gives more detail about an information resource to help identify, manage, and share information.

Office of Primary Responsibility (OPR) – The department or division within JIBC that has primary responsibility for managing information to satisfy operational, financial, legal, audit and recordkeeping requirements.

Personal Information – Recorded information about an identifiable individual other than contact information.

Principle of Least Privilege – Users and systems should have only the minimum permissions and access rights needed to perform their specific authorized functions and no more.

Records – Information created, received, and maintained as evidence and as an asset by JIBC in pursuit of legal obligations or in the transaction of business.

Records Management – Efficient and systematic control of the creation, receipt, maintenance, use, and disposition of records, including processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.

Records Officer – Individual responsible for a provincial records management program that meets the requirements of the Information Management Act and the directives of B.C.’s chief records officer.

Sensitive Information – Data that could significantly harm an individual or organization if exposed or misused and requires extra protection.

Service Provider – Any person or organization contracted to perform services for JIBC.

Standards – Documented rules, guidelines or characteristics for products, processes or services that are adopted by an organization to achieve consistent and standardized results.

System of Record – Information storage system that JIBC has deemed to be the authoritative instance of a particular Data element.

Governance Model

JIBC’s information governance practices balance central control with business unit autonomy. This model depends on shared development of Institute-wide policies and Standards, local accountability for their application, and centralized support.

Information Creation and Usage

JIBC creates and receives Information in the normal course of work, providing evidence of JIBC’s activities, transactions, and events. 

All Information has an authoritative repository or System of Record.

Data is recorded at its point of origin, wherever possible, to ensure its accuracy, integrity, and timeliness. Data should be captured immediately when it is generated by the person responsible for creating it, avoiding intermediaries and manual transfers of information into different systems, media, or formats. Data that originates outside of JIBC should enter systems directly from those sources.

Data validation processes check and confirm the accuracy, quality, and integrity of Data at time of creation or capture, ideally before the Data is stored, used, or processed.

Data processing should ideally occur without Data movement to maximize the speed from input into a system to a business outcome.

In cases where duplicate Information must be retained, an Office of Primary Responsibility (OPR) must be clearly identified. The OPR must manage the Information to meet the needs of the entire Institute.

Information must be adequately described so it can be managed throughout its Lifecycle. This includes:

• applying useful and consistent Metadata to Information following applicable Standards and other relevant requirements,
• using naming conventions; and
• applying Information Schedules.

Records Management

JIBC maintains a Records Management program that ensures the capture, preservation, and accessibility of Records in compliance with regulatory requirements. The program ensures Records are authentic, reliable and maintain their integrity over time.

All Records must be managed in accordance with applicable Information Schedules that classify Records and set retention periods based on the business context and information needs of the JIBC Community, regulators, and the public. 

Information Discovery, Access, and Integration

JIBC ensures wide access to Information to support collaboration, effective decision-making, and prompt delivery of services while maintaining strict safeguards to protect privacy and maintain confidentiality of Sensitive Information.

Information must be classified, organized, and described effectively so authorized users can locate and retrieve Information efficiently.

Information must be classified based on its sensitivity and criticality to determine appropriate security controls.

Job roles and responsibilities dictate access levels. Access to sensitive or Personal Information is granted based on the Principle of Least Privilege, restricted to users who require it for authorized job functions.

JIBC applies FAIR principles to Information assets (findable, accessible to authorized users, interoperable, and reusable) and maintains a centralized data catalogue to help users discover and understand the Data. Interoperable Standards facilitate sharing, integration, and long-term preservation.

Information Sharing

Management must make every effort to share Information across divisions and not keep redundant Information without justification.

When sharing JIBC Information with governments, Service Providers, or other third parties, all parties must agree to the following terms in writing:

• purpose for sharing Information and permitted usage;
• legal authority permitting Information disclosures;
• Data description and location;
• safeguards, security obligations, and breach requirements;
• audit and assurance rights;
• sub-processor controls; and
• information retention and destruction obligations upon contract termination.

Decision Support

To promote institutional effectiveness, the Institute provides services to the JIBC Community that use Data to drive continuous improvement, strategic planning, public accountability, and data-informed decision-making.

Data literacy training and resources support the JIBC Community in deriving meaningful information from Data through effective and ethical Data analysis, interpretation, and communication.

Decision support applications that use Advanced Analytics with JIBC’s Data must be transparent, auditable, and subject to documented validation, including bias and fairness assessments and regular monitoring.

While AI applications may support decision-making, humans must retain oversight and accountability for their decisions; AI applications may not independently make or implement decisions.

Information Preservation and Storage

JIBC is committed to preserving Information to maintain the integrity of its operations and decisions, comply with legal obligations and ensure accountability. The following principles apply:

• Information must be stored in a manner that preserves its authenticity, accessibility, and context throughout the Lifecycle.
• JIBC will maintain Information in formats that are stable and accessible to ensure its authenticity and accessibility throughout its Lifecycle.
• Information must be managed per applicable Information Schedules and relevant legislation.
• Persistent linkage of metadata with Information is required to maintain context and facilitate auditing.
• Any migration of Data must follow JIBC policies, procedures and Standards, adhere to established policies, and be subject to appropriate testing and documentation.
• Transferring physical Records to offsite storage must use B.C. government approved records storage facilities and services.

Information Transfer and Disposal

As a public body, JIBC serves as a steward of public Information. It ensures that Records are preserved as long as they have value and are disposed of with legal authority and accountability in accordance with this policy and related Standards and procedures.

• No Information in JIBC’s Custody or Control will be destroyed or removed except in accordance with approved Information Schedules.
• Final destruction of records requires authorization from JIBC’s Records Officer.
• JIBC must authorize the transfer of information in writing to other organizations or individuals and ensure there are adequate access, privacy, confidentiality, and security safeguards.
• Records of permanent historical value must be transferred to the appropriate provincial authority, which will subsequently forward them to BC Archives, in accordance with the Information Management Act.
• Records subject to actual or reasonably anticipated litigation, audit, or access request are placed under legal hold and must not be altered or destroyed.

Information Security

Failure to secure information may result in the corruption, loss or devaluation of valuable information and trigger legal actions, financial penalties, and inhibit the Institute’s ability to meet its mission.

JIBC secures and protects Information to comply with regulations and to ensure its integrity and availability to the JIBC Community. JIBC ensures that proper technical, physical, and administrative safeguards are put in place, and appropriate backups and disaster recovery measures are administered and deployed for all Information repositories and Systems of Record.

All individuals with access to Information must safeguard and protect the Information from inappropriate access, use, disclosure, alteration, and disposal.

Inappropriate Disclosure or Loss of Sensitive Information

Any actual or suspected unauthorized or improper access, use, disclosure, or disposal of Sensitive Information must be reported immediately to the Chief Information Officer, General Counsel, and Information Governance Committee Chair.

Data Quality

JIBC maintains the quality and authenticity of Information to meet regulatory requirements, ensure that Information is fit for its intended purpose, and to produce trustworthy insights.

Data Standards apply across the Institute to ensure Data is consistent, accurate, findable, and reusable across different systems, groups, and organizations. Data quality is measured to assess compliance with the Standards and monitor progress in improving JIBC’s Data quality.

Information must be corrected at its source and replicated to downstream systems where practicable.

Technologies

JIBC maintains an inventory of all Systems of Record that contain information in its Custody and Control.

The JIBC Community must only use approved systems for work-related activities and may not enter Sensitive or Personal Information into any other system or tool to ensure JIBC can effectively govern Information and remain compliant with legal requirements.

All systems that contain JIBC Information must:

• be designed to manage information throughout its Lifecycle;
• be regularly monitored and maintained;
• have appropriate privacy, security, access, and Data quality controls; and
• be included in a cybersecurity program that identifies, measures, prevents, and manages risks and vulnerabilities to threats.

Regulatory Compliance

Information governance minimizes JIBC’s risks through compliance with internal and applicable external guidelines, regulations, directives, policies, and procedures. The Institute monitors for changes in external requirements that may drive internal changes.

JIBC’s privacy management program meets the requirements of BC’s Freedom of Information and Protection of Privacy Act and establishes best practices for managing personally identifiable information.

Ethical Use of Information

JIBC is transparent about the Information relied upon to support decisions. Staff and faculty take responsibility for the accuracy and reliability of the Information used in their work and are accountable for the outcomes of their Information usage.

JIBC Community members are accountable for identifying and mitigating bias in analytics and using Data in a manner that respects human dignity.

JIBC respects the rights of individuals to control their Personal Information and the rights of organizations to control their intellectual property. The Institute seeks informed consent to use third-party Information and abides by their restrictions.

JIBC respects the sovereignty of Indigenous Knowledges in accordance with the Intellectual Property policy and follows the First Nations Principles of OCAP – ownership, control, access, and possession.

JIBC manages personal Data ethically, balancing individuals’ privacy rights and public access obligations. The Institute acknowledges the right of individuals to know what Data is being collected, how it is being used, and what benefits they will receive from its collection and use.

JIBC provides opportunities to correct inaccurate Data within a reasonable time.

JIBC conducts privacy impact assessments to identify and manage risks in accordance with the Privacy Impact Assessments Procedure.

JIBC follows the Tri-Council Policy on Ethical Conduct for Research Involving Humans.

Members of the JIBC Community must not access any Information they do not need to perform their immediate business responsibilities, regardless of whether this Information is accessible to them.

Roles and Responsibilities

Information governance roles and responsibilities exist to champion the vision for information management, build an information-aware culture, and ensure fit-for-purpose Information that achieves maximum value across JIBC.

The Information Governance Committee recommends strategic direction, policies and related initiatives for information governance to the Executive Committee, develops a solid foundation for good information management at JIBC, and fosters an organizational culture that values Information and its governance.

The Information Stewardship Guidelines identify all roles and responsibilities associated with information management across the Lifecycle. Individuals and departments with specific stewardship roles must maintain documentation for Information under their stewardship such as training materials, Standards, controls, and information flows.

Employee Awareness

Employees are required to make themselves aware of all JIBC policies and procedures. Lack of awareness of this or any other JIBC policy does not excuse an employee from responsibility for their actions.

Related Policies and Procedures

• 3107 Intellectual Property Policy

Documents and Forms

• First Nations Principles of Ownership, Control, Access, and Possession (OCAP)
• Tri-Council Policy on Ethical Conduct for Research Involving Humans