About this Video

• Video Title: Protecting Student Privacy Rights in Ontario
• Channel: Information and Privacy Commissioner of Ontario
• Speakers: The transcript does not identify the speaker by name.
• Duration: 20:38

Introduction

This webinar from the Information and Privacy Commissioner of Ontario (IPC) discusses student privacy rights in Ontario schools, focusing on the responsibilities of school boards, officials, and teachers under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). The video also provides best practices for protecting student data and handling privacy breaches.

Key Takeaways

• MFIPPA defines personal information: This includes recorded information about an identifiable individual, encompassing details like names, addresses, photos, health information, and student records. Even data without names can be considered personal information if student identities are easily determined.
• Legal Authority for Data Collection: Schools must have legal authority (e.g., Education Act) or demonstrate necessity for collecting personal information beyond parental consent. The collection must be rationally connected to a lawfully authorized activity.
• Data Use and Disclosure: Personal information can only be used for the purpose collected or a consistent purpose (reasonably expected by parents/students). New uses require consent. Disclosure is limited to specific circumstances: delivering educational services, legal requirements, or individual consent.
• Access to Information Rights: Students (under 16) and their legal guardians have the right to access student information. Schools should document access requests (written or oral consent). A decision letter must be issued within 30 days.
• Data Retention and Security: MFIPPA mandates minimum retention periods (one year or as per bylaw/resolution). Secure destruction of records is necessary. Reasonable security measures must be implemented to prevent unauthorized access and data loss, proportional to the risks involved. Regular threat and risk assessments are strongly recommended.
• Privacy Breaches: Common breaches include lost devices, misdirected mail/email, and unauthorized disclosures. The IPC investigates complaints; public reports may be issued, naming involved school boards, requiring notification to affected parties.
• Online Educational Tools: The IPC recommends due diligence when using such tools: assigning responsibility for decisions, implementing evaluation policies, providing ongoing training, and notifying students/parents about data collection practices. Specific best practices for online communication platforms (video conferencing, etc.) are also highlighted.
• IPC Complaint Reports: Two reports detailed compliance with MFIPPA but highlighted needs for stronger oversight of service providers and transparency with parents/students. These emphasize the importance of combining strong contracts with monitoring and oversight.
• Children and Youth in a Digital World: The IPC's strategic priority is to champion access and privacy rights for children and youth in the digital realm.

The four minimum steps the IPC recommends when considering the use of online educational tools and services are:

1. Assign responsibility for making decisions to use online educational tools.
2. Implement policies and procedures to evaluate, approve, and support their appropriate use.
3. Provide teachers and staff with ongoing privacy and security training.
4. Notify students, parents, and guardians that the service may collect personal information and explain how the information will be used.