School Board Update
IPC Publishes Guidance for School Boards on Their Obligations Under MFIPPA
Date: January 15, 2019
The Information and Privacy Commissioner of Ontario (IPC) has published A Guide to Privacy and Access to Information in Ontario Schools (Guide). The Guide provides a succinct overview of a school board’s responsibilities under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA or Act). The Act obliges school boards to protect individual privacy and maintain the freedom of information for records in their custody or control. The Guide provides particularized examples from IPC decisions concerning school boards.
School boards can consult the Guide for direction on the institution’s obligations to protect individual privacy and provide access to information rights. The Guide also covers special circumstances, such as disclosure to law enforcement or children’s aid societies.
1) Protection of individual privacy
The Guide provides a summary of a school board’s duty under Part II of MFIPPA to limit the collection, retention, use and disclosure of personal information. It also provides a detailed summary of a school board’s requirement for lawful authority to collect personal information and the circumstances wherein the institution must notify students or parents of such a collection. School boards can consult the Guide to review the interplay between MFIPPA rules and the Education Act duty to maintain an Ontario Student Record for each student. The following topics are covered:
Guidance on the collection of personal information by a school board:
- How does the Act limit a school board’s ability to collect personal information?
- What personal information is to be included in an Ontario Student Record?
- When can a school board collect personal information directly?
- When is the duty to provide notice when collecting personal information engaged?
Guidance on the use and disclosure of personal information by a school board:
- When can a school board use a student’s personal information?
- When can a school board disclose a student’s personal information?
- When is the disclosure of a student’s personal information mandatory? This section covers:
- Disclosure to medical officers of health
- Notifying parents of potential harm to students
- Disclosure to eligibility review officers
- Duty to report a child in need of protection
- Occupational health and safety
- What information should be disclosed in an emergency?
- What information should be disclosed in compassionate circumstances?
Guidance on consent to collect, use and disclose personal information:
- At what age can a student provide valid consent?
- Must consent be in writing?
Guidance on safeguarding and retaining information:
- How long are school boards required to keep student records?
- When can records be destroyed or removed from the Ontario Student Record?
- What happens to the Ontario Student Record when a student changes schools?
- How do school boards safeguard records?
2) Access to Information
The Guide provides a summary of a school board’s duty under Part I of MFIPPA to provide access to information in its custody or control. School boards can consult the Guide to review the nuances in their obligation to provide access to information to students, parents, and the general public. Moreover, the Guide provides a review of a school board’s duty to ensure personal information is accurate and the mechanism for students or parents to request a record be corrected. The following topics are covered:
How do students and parents access personal information?
- Personal information can be requested either under the Education Act, which engages the Part II Protection of Individual Privacy provisions of MFIPPA, or under the Freedom of Information provisions in Part I of the Act.
Do individuals have a right to access general records from a school board?
- Do students need to reach a certain age before they can exercise their access rights?
- How does a child’s age affect the parent’s right of access to personal information?
- Do non-custodial parents have a right to access a child’s school records?
How must a school board process correction requests?
- What steps must a school board take to reasonably ensure that student information is accurate?
- What reasonable measures is a school board required to take to ensure that records are accurate?
- Can students and parents request correction of inaccurate records?
- What is the process for requesting a correction?
3) Special topics
The Guide also provides insights on a school board’s statutory obligations in a number of special circumstances, such as:
- School photographs
- Mandatory disclosure to a children’s aid society
- Disclosure to police
- Collection, use and disclosure of health information
- Privacy in the networked classroom and the use of online educational services.
Conclusion
School boards should periodically review their policies and practices to ensure they comply with their obligations under MFIPPA. Hicks Morley regularly helps its school board clients with this process. If you would like our assistance to ensure statutory compliance, please contact a member of our Information, Data Security and Privacy Practice Group.
The article in this client update provides general information and should not be relied on as legal advice or opinion. This publication is copyrighted by Hicks Morley Hamilton Stewart Storie LLP and may not be photocopied or reproduced in any form, in whole or in part, without the express permission of Hicks Morley Hamilton Stewart Storie LLP. ©
