The Guide contains information to assist school board officials and education professionals to be compliant with the applicable privacy legislation in Ontario in protecting students’ personal information.
In January 2019, the Information and Privacy Commissioner of Ontario published A Guide to Privacy and Access to Information in Ontario Schools (Guide). The Guide contains the following information to assist school board officials and education professionals to be compliant with the applicable privacy legislation in Ontario in protecting students’ personal information:
Types of personal information that can be collected by school boards; and
When, how, to whom, and to what extent such information may be collected, used, disclosed, retained or corrected.
Specifically, the Guide covers the school board officials’ and education professionals’ rights and obligations regarding students’ personal information in the following seven topics:
- Collecting personal information
- Using and disclosing personal information
- Consent to collect, use and disclose personal information
- Safeguarding and retaining information
- Access to information
- Correction of personal information
- Special topics
To properly safeguard the personal information and privacy of students, it is crucial for school board officials and education professionals to understand and comply with their obligations in collecting, accessing, retaining and disclosing students’ personal information.
The following are select highlights from the Guide:
Ontario’s Legislation on Privacy of and Access to Students’ Personal Information
In Ontario, the main legislation regarding the protection of students’ personal information in the school system are the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and the Education Act. Depending on the situation and types of personal information involved, other legislation such as the Personal Health Information Protection Act, the Child, Youth and Family Services Act, and the Occupational Health and Safety Act may apply.
School Boards’ Collection of Students’ Personal Information
The MFIPPA defines personal information as “recorded information about an identifiable individual” and sets out rules regarding collection of personal information. Under the MFIPPA, schools are allowed to collect personal information of students only if the collection is expressly authorized by law or necessary to the proper administration of a lawfully authorized activity.
The Education Act sets out rules regarding access to and the collection of information contained specifically in the Ontario Student Record (OSR). The OSR is a record of a student’s progress through the school system in Ontario and includes information such as biographical data, names of parents, special health information, report cards and special education records. All public and separate school boards are required to have an OSR for each student and private schools may choose to create OSRs for their students. OSRs must be established and maintained in accordance with the Ministry of Education’s Ontario Student Record (OSR) Guideline, 2000.
School Boards’ Use of Students’ Personal Information
According to the MFIPPA, schools may use a student’s personal information only under the following conditions:
- with consent;
- for the purpose for which it was collected, or for a consistent purpose; or
- for a purpose for which the information may be disclosed to the school board under the MFIPPA.
Under the Education Act, schools’ use of the OSR is restricted to the following circumstances:
- by supervisory officers, principals and teachers to improve the instruction and other education of the student;
- to respond to requests from students and parents to correct or remove information from the OSR;
- to allow students and parents to examine the students’ OSR;
- for disciplinary proceedings;
- to prepare reports required by the Education Act; or
- to prepare a report related to the student’s application for education or employment.
School Boards’ Disclosure of Students’ Personal Information
Under the MFIPPA, students’ personal information may be disclosed in some situations, including:
- with consent;
- for the purpose for which the information was obtained, or for a consistent purpose;
- to an officer, employee, consultant, or agent of the institution who needs the information in the performance of their duties;
- for the purpose of complying with law;
- in compelling circumstances affecting health and safety;
- to a law enforcement agency in order to aid in an investigation;
- where the student or his or her parents request access; or
- to notify a student’s close relative, friend or spouse about a student’s injury, illness or death in order to facilitate or enable contact (the information disclosed must be restricted to the information required to facilitate contact).
Under the Education Act, written permission from the student’s parent, guardian or the adult student is generally required before a school board discloses a student’s personal information in the OSR. In the following situations, the OSR may be disclosed without written permission:
- disclosures required by the Ministry of Education or school board;
- disclosures of certain limited information about students to a medical officer of health; or
- access by the student to his or her own records, and by his or her parent or guardian where the student is under 18 years of age.
Under special circumstances, it is mandatory for school boards to disclose students’ personal information. Some examples of such circumstances are as follows:
- Disclosing the name, address and telephone number of any student and their parent, and the student’s birth date when requested by the local medical officer of health.
- Notifying parents or guardian of involved students if a student has been harmed in an activity that could result in their suspension or expulsion. When notifying the parent or guardian of the harmed student, the principal must only disclose information that is necessary to explain the nature of the activity that resulted in harm to the student, the nature of the harm, the steps taken to protect the student’s safety, and the supports that will be provided to the student in response to the harm.
- Disclosure to eligibility review officers, if written demand for production of records is made.
- Reporting to a children’s aid society if there is a reasonable ground to believe that a child is in need of protection.
- Providing personal information to the school board’s employees if disclosure of information is reasonably necessary in order to protect the employee from physical injury.
- Disclosure of records to the public or affected individuals if there are reasonable and probable grounds to believe that it is in the public interest to do so, and the record reveals a grave environmental, health, or safety hazard to the public. Notice should be given to the individual whose information is to be disclosed only if it is feasible to do so.
While consent is not required in the above circumstances, school boards should provide general information to the school community regarding the requirements for disclosure.
With respect to retention of records, school boards should be aware that the legislation requires personal information be retained for at least one year after use, or for a period set out in a bylaw or school board resolution, whichever is shorter. This requirement does not apply if the student, or their parent or guardian, in the case of a student under age 16, consents to an earlier disposal of the information, or if the information is credit or debit card payment data.
Comment
In addition to the selected highlights above, the Guide provides more details regarding the collection, usage, and disclosure of students’ personal information. The Guide also covers useful information for school board officials and education professionals regarding their rights and obligations in retaining, safeguarding, and correcting students’ personal information, as well as some nuances regarding various stakeholders’ access to students’ personal information.
Lastly, the Guide covers special topics including:
- school photographs;
- disclosure to a children’s aid society;
- disclosure to police;
- collection, use and disclosure of health information; and
- privacy in the networked classroom and the use of online educational services.
School board officials and education professionals are encouraged to familiarize themselves with the information in the Guide to better understand the rules regarding privacy and access to information of the students’ personal information in the school system. View the complete Guide.