Student privacy and your ontario college

Student Privacy and Your Ontario College

Dan MichalukCSC Annual ConferenceMay 29, 2012



• FIPPA Basics• FIPPA and Collection of PI• Use and Disclosure of PI under FIPPA• Safeguarding PI under FIPPA• Enforcement and Liability• Discussion of College Adult Upgrading Issues• Question & Answer


FIPPA Basics

• FIPPA is the “Freedom of Information and Protection of Privacy Act”

• FIPPA does two things• Protects student privacy

• Provides a right of access to college records


FIPPA Basics

• Josie enrols in a concurrent education course. The registrar’s office opens a record for her in its student records system. It includes her name, address and date of birth. When Josie finishes the course successfully, her record is updated.

What personal information has the College collected?


FIPPA Basics

• In, class Josie’s professor is de-briefing a self-reflection unit. Quite spontaneously, Josie shares a very sensitive personal story about her upbringing with the class. The professor takes no notes.

Does the College have applicable duties under FIPPA?


FIPPA Basics

• The privacy part protects “personal information”• Information about an identifiable individual

• Not business contact information

• Generally not information about someone in a

professional capacity – e.g. work product

• This includes information that is not recorded


FIPPA and Collection of PI

• FIPPA is not a consent-based statute• Ordinarily must meet two essential requirements

• necessary to the proper administration of a lawfully

authorized activity and

• collected directly from the individual unless

exception applies

• Plus must give notice of collection



• Who’s collecting it?• An institution that collects PI is accountable for it

• So in collaborative efforts, you need to understand

who is doing the collection

• Two potential scenarios involving Ministry• You’re collecting PI for you and the Ministry• You’re collecting PI for the Ministry alone



• For what purpose is it being collected?• The stated purpose is the key basis for collection,

use and disclosure

• Notice of collection must state the “principal purpose

or purposes”

• Must also state the legal authority for the collection –

ordinarily section 2 of the OCAAT – and provide

certain contact information



• Is the collection necessary in light of the purpose?• Applies with or without consent

• Applies to each data element collected

• IPC applies a strict test (upheld by Court of Appeal)• More than merely helpful• Less intrusive means must be taken

• Different than reasonable in all the circumstances



• Can you collect indirectly?• Consent

• Determining suitability for honour or award

• Law enforcement (but internal disciplinary

investigations have been ruled not to be law

enforcement)

This restriction is so strict it is a problem for colleges, especially because it could preclude legitimate threat assessment efforts.


Use and Disclosure of PI under FIPPA

• Use versus disclosure• Neither are defined

• Under FIPPA an internal communication or a

communication to an agent is treated as a

disclosure

• A communication to an external entity for its own

purposes usually represents a disclosure



• The statute is fairly permissive• Yes - for the purpose you collected it

• Yes - for a “consistent” “secondary purpose”

• Consistent if individual “might reasonably have

expected such a use or disclosure”



• The statute is fairly permissive (cont.)• Yes – to an employee/agent “who needs the record

in the performance of their duties and where

disclosure is necessary and proper in the discharge

of the institution’s functions”



• FAQ – Can a college report crime to the police?• Yes

• There’s a public interest in the reporting of crime

• There’s a very broad exception in FIPPA

• Note – the police may not be able to receive student

records without first seeking a warrant

• Note – the same rule doesn’t apply to concerns that

arise out of a health care relationship



• FAQ – Can a college share information about a former student with another college?• Institutions sometimes ask other institutions for a

summary of their dealings with a student

• In most circumstances sharing this information

without consent is prohibited



• FAQ – Can a college share information with a student’s parents?• Generally not (age 16 is the cut off)

• Beware of the “health and safety” exceptions in

sections 42(1)(h) and 11

We know that some parents can be great allies in helping to manage students at risk. It may be reasonable in some circumstances to impose a parental contact

requirement as part of a behavioral contract.


Safeguarding PI under FIPPA

• The chair of the each college board has a duty to• ensure “reasonable measures” are taken

• ensure access is on a need to know basis

• ensure “reasonable steps” taken in destruction

process (secure destruction per IPC guideline)

• Duty may be delegated via governance structure• No maximum retention duty, but keeping PI

comes with a responsibility for security



• Best practices for safeguarding PI• Periodic risk assessment procedures

• Intrusion detection and security audit structures

• Records management structures

• Human resources policy

• Physical transfer of personal information policy

• Disposal procedures

• Privacy breach procedures



• Systematic is good, but what’s your low hanging fruit?



• Systematic is good, but what’s your low hanging fruit?• Anecdotally…

• …Lost USB keys

• …Lost laptops

• …Recycling versus shredding

• …Departing employees


Enforcement and Liability

• FIPPA enforcement• Rests on voluntary compliance of public sector

institutions

• IPC will handle most complaints through an informal

resolution process

• Complaints that are not resolved will be investigated

and the subject of a public report, often with

recommendations



• Civil liability for privacy breaches• Data breach liability is real

• Breach response costs are significant and will be

borne for breaches of almost any consequence

• Damage claims are possible• A question of negligence• Best defence will arise from due diligence



• The new intrusion upon seclusion cause of action• Not clear how this will affect day-to-day college

administration

• Only covers unauthorized collections of information

• Rests on a “reasonable expectation of privacy”

• Also must establish the an intrusion that is “highly

offensive”


College Adult Upgrading Issues


Question & Answer


Dan MichalukCSC Annual ConferenceMay 29, 2012

Technology

Student privacy and your ontario college