Using and Disclosing Personal Information in School Jurisdictions

Revised January 2007

PDF Version (pdf)

• Introduction
• Requirement to Give Notice
• Using or Disclosing Personal Information
• Consistent Use or Disclosure of Personal Information
• Requesting Consent
• Providing Notice
• Excerpts from the FOIP Act and Regulation
• Sample Notice Form
• Sample Consent to Disclose Personal Information to the Media/Outside Organizations 10
• Sample Consent to Disclose Personal Information to the School Council
• Sample Copyright Release Form
• Sample Francophone Education Eligibility Question

This paper discusses the Freedom of Information and Protection of Privacy (FOIP) Act issues related to collecting, using and disclosing the personal information of students and parents in a school setting.

Part 2 of the FOIP Act establishes conditions and obligations that public bodies must meet in protecting the privacy of individuals whose information is in their custody or under their control.

Sections 33 to 43 of the Act establish controls over the collection, use and disclosure of personal information and requirements for protecting, correcting, retaining and assuring the accuracy of such information.

Public bodies collect and retain information for a variety of purposes that are essential to their effective and efficient operation. These purposes are balanced carefully with the interests of individuals in their own information and privacy.

Section 33 of the Act sets out the purposes for which a public body may collect information. Section 34 sets out the manner of collection of information. Section 39 controls uses of personal information and section 40 controls disclosure of that information. Section 41 defines a consistent use or disclosure. These sections need to be looked at together to consider how a school jurisdiction can collect and use information about students and parents.

In practice, both students and parents provide information to the schools. Depending on the age of the student and other factors, notices and consents may be given to students and parents.

For ease of explanation of these complex issues, this document will only refer to advising parents. For a more complete discussion of privacy, see Chapter 7, Protection of Privacy, in the FOIP Guidelines and Practices publication.

When public bodies collect personal information directly from individuals, section 34(2) of the FOIP Act requires the public body to provide notice to the individual. The notice must advise the individual of:

• the purpose for which the information will be used,
• the legal authority for collecting the information, and
• who to contact if they have questions.

Parents and students provide information to schools at the time of registration for busing, students union, extracurricular activities and so on. Each time personal information is collected, the individual should be informed of the school’s uses of the information. For example, the parents’ names and phone numbers may be used for many purposes. They may be used to establish busing routes, to contact the parent in the event the student is ill, to advise of or confirm student absences, to set up a meeting with the parent, etc. The calls may be made by a school secretary, teacher, bus driver, or others.

All of these uses are reasonable and permitted uses of the parents’ names and phone numbers (s. 39(a) of the FOIP Act) as they are part of the school’s obligation to provide every student with an education program. Where use involves disclosure within a public body, this would be permitted under either s. 40(1)(c)or (h) of the FOIP Act.

Section 39 of the FOIP Act sets outs how information may be used by a public body.

In Section 39(a) and (b), information may be used:

• for the purpose for which the information was collected,
• for a use consistent with that purpose, or
• when the individual the information is about has identified the information and has consented in the prescribed manner to the use (see section 6 of the FOIP Regulation).

In section 40(1)(c), information may be disclosed:

• for the purpose for which the information was collected, or
• for a use consistent with that purpose.

In other words, schools do not need consent when they use or disclose personal information for the purposes for which the information was collected.

For other uses, the public body must get consent from the individual prior to using the information.

Section 41 of the FOIP Act sets out consistent use. The use must:

• have a reasonable and direct connection to the original purpose for which the information was collected, and
• be necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body.

Section 41 establishes a two-part test to determine whether a proposed use or disclosure of personal information is a consistent use or disclosure.

Under the first part of the test the use or disclosure must have a reasonable and direct connection to the original purpose. In other words, would an individual reasonably have contemplated the use or disclosure in those circumstances?

Under the second part of the test the board must be able to show that the use or disclosure of the information is necessary for performing a statutory duty of the board, or for operating a legally authorized program of the board.

Because of the very nature of a "consistent use," there will not always be a statutory provision that will outline the proposed activity. Examples of such consistent use are outlined in the FOIP Guidelines and Practices publication. For example, personal information collected to provide a service to an individual may be reasonably used to evaluate the effectiveness and value of the program.

The School Act does not impose a statutory duty to perform, nor does it legally authorize many of the programs operated by schools, such as the creation of honour rolls, the organization of sporting teams or events, or yearbook-related activities. It does mandate transportation (s. 51), and establishes an obligation to ensure students attend school (ss. 8, 13, 14) but few other programs are specified as such.

As yet there are no Commissioner’s Orders interpreting section 41(b). Boards have the option of establishing policies or rules on traditional or common practices, provided that those policies are within the jurisdiction of the board.

Section 6 of the FOIP Regulation sets out how to properly obtain consent in writing, in electronic form, and orally.
 
Consent in writing, must indicate to whom the information may be disclosed and how it may be used.
 
Before consent can be accepted orally or electronically, the head of the public body must establish rules respecting the purposes where these forms of consent are acceptable. Processes to authenticate the individual giving consent and to maintain a record of the consent are also needed.
 
For more information about these requirements, see Bulletin No. 17 on Consent and Authentication.

According to the FOIP Guidelines and Practices publication, a form or other instrument requesting consent should:

• indicate the purpose of the collection;
• indicate that consent is voluntary;
• indicate that consent may be revoked at any time;
• to the extent possible, identify any consequences that may result from refusal; and
• indicate the period of time during which consent remains valid.

Consent may be sought at the time of collection, if the use is anticipated before collection takes place, or during administrative processes that require periodic information collection.

If a different use is approved by the individual concerned, it serves as an indication that the person knows the consequences of the use of his or her personal information and has been provided with enough facts to make an informed decision about whether or not to agree to the use.

Keep in mind that a school jurisdiction does not need consent in order to collect the information it needs to operate its programs. Authority to collect is in sections 33 and 34 of the FOIP Act. Similarly, schools do not need consent to use or disclose this information for educational purposes.

When consent has been requested but has been denied, or no answer has been received, the school cannot use the information for that. Absence of consent (i.e. parent does not return the consent form) must be interpreted as the absence of authorization.

Consents must be tracked. If a parent has refused consent to an identified use or disclosure, then it would be a serious breach to use or disclose the information in question. A school jurisdiction, through its administrators, will need to restrict participation of the particular student in the activity described in the consent form for which consent was not provided. Alternatively, the school could rework the activity so that it can be done without using or disclosing the personal information.

Consent should be sought for uses and disclosures of information which are not part of the board's duty to provide an education program and which are not addressed by the list of permitted disclosures contained in section 40 of the FOIP Act. This may include disclosures to the media, extramural sports associations, community services and so on.

When collecting personal information, school jurisdictions need to give notice of the purpose for which the information is collected, as required by s. 34(2).

The purpose can be described broadly in terms of providing an educational program that meets the needs of students. Examples of specific uses of information may then be listed to provide additional information to parents. Such a list does not need to be all-inclusive, since it is only meant to give examples of potential uses of personal information.

Once notification is provided pursuant to section 34(2), section 39(1)(a) allows a board to use the information according to the terms of the notice.

Parents would be advised of the legal authority to collect the information, and given a contact number if they have questions. If parents object to a use of information, their wishes should be respected wherever possible. For example, privacy concerns relating to custody issues should be accommodated.

This approach puts an obligation on school jurisdictions to consider whether any uses or disclosures of information are outside of the purposes of providing an educational program for students.

For illustration purposes, consider the idea of putting an imaginary box around the school and school-related activities. Activities involving the use or disclosure of personal information occurring within the school are generally going to be part of the educational program of the school. Activities occurring outside the school, i.e. involving the eligibility of students for community programs, may not be part of the educational program of the school and likely require a specific written consent.

It is very important that school jurisdictions carefully consider the current uses and disclosures of information, and the purposes and authorizations for each.

Schools have the option of asking individuals to sign the notice form. This signature is only an acknowledgement that the parent has read the form. Schools should be cautious of the wording they use. If the statement on the form asks the parent to agree to the foregoing uses, then the process has been inadvertently shifted to consent, but the standard for informed consent may not be met.

FOIP Act

33 No personal information may be collected by or for a public body unless

a) the collection of that information is expressly authorized by an Act of Alberta or Canada,

b) that information is collected for the purposes of law enforcement, or

c) that information relates directly to and is necessary for an operating program or activity of the public body.

FOIP Act

34(2) A public body that collects personal information that is required by subsection (1) to be collected directly from the individual the information is about must inform the individual of

a) the purpose for which the information is collected,

b) the specific legal authority for the collection, and

c) the title, business address and business telephone number of an officer or employee of the public body who can answer the individual’s questions about the collection.

FOIP Act

39 A public body may use personal information only

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose,

b) if the individual the information is about has identified the information and consented, in the prescribed manner, to the use, or

c) for a purpose for which that information may be disclosed to that public body under section 40, 42 or 43.

FOIP Act

40(1) A public body may disclose personal information only

c) for the purpose for which the information was collected or compiled or for a use consistent with that purpose,

d) the individual the information is about has identified the information and consented, in the prescribed manner, to the disclosure,

e) for the purpose of complying with an enactment of Alberta or Canada or with a treaty, arrangement or agreement made under an enactment of Alberta or Canada,

f) for any purpose in accordance with an enactment of Alberta or Canada that authorizes or requires the disclosure,

h) to an officer or employee of the public body or to a member of the Executive Council, if the information is necessary for the performance of the duties of the officer, employee or member,

...

FOIP Act

41 For the purposes of sections 39(1)(a) and 40(1)(c), a use or disclosure of personal information is consistent with the purpose for which the information was collected or compiled if the use or disclosure

a) has a reasonable and direct connection to that purpose, and

b) is necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body that uses or discloses the information.

FOIP Regulation

6(1) The consent of an individual to a public body’s using or disclosing any of the individual’s personal information under sections 39(1)(b) or 40(1)(d) of the Act

a) must be in writing, and

b) must specify to whom the personal information may be disclosed and how the personal information may be used.

(2) The consent or request of a third party under section 17(2)(a) of the Act must be in writing.

Freedom of Information and Protection of Privacy Act (FOIP Act)
Collection of Personal Information Notice under s. 34 of the FOIP Act

The FOIP Act, which came into effect for school boards on September 1, 1998, sets controls and standards on how public bodies, such as school boards, collect, use and disclose personal information that is in their custody or under their control.

The FOIP Act requires that school boards collect personal information directly from individuals the information is about, that these individuals be provided with the legal authority for the collection, be explained the purpose of the collection and how the information will be used, and be provided a contact person should they have any questions relating to this activity.

• The information collected on this form as part of the school registration process is personal information as referred to in the FOIP Act. This personal information is collected pursuant to the provisions of the School Act and its regulations (e.g. for the establishment of a student record, determination of residency) and pursuant to section 33(c) of the FOIP Act as the collection is related directly to and is necessary to a school board's obligation to provide students with an education program that meets their needs and to provide a safe and secure school environment (e.g. program placement, determination of eligibility and/or suitability for provincial or federal funding, contact and health related information in the event of problems or emergencies). Personal information may also be provided to the Minister of Education for the purpose of carrying out programs, activities, or policies under his administration (e.g. research, statistical analysis).

The remainder of the notice is optional.

Once the information is collected and compiled, the name school board believes the uses listed below are part of a vital, healthy and functioning school and participation of all students is important and encouraged. Here are examples of activities where the information may be used:

• the taking of individual, class, team or club photos for school purposes.
  
• the use of student information, including photos, for the issuance of transit/bus transportation passes and for other identification purposes.
  
• the use of students’ names in honour rolls, work ethic (listings), graduation ceremonies, scholarship or other awards within the school or school boards.
  
• the use of students’ names and academic information necessary for determining eligibility or suitability for provincial, federal or other types of awards or scholarships in the event the board applies on a student's behalf.
  
• the use of students’ names, related contact information and telephone numbers for absenteeism verification.
  
• the taking of photos and/or videos of classroom activities, and their use by the media or other organizations where students are not interviewed or identified by name or face. Where individual students are identified or interviewed and the material will be used outside the school a separate and specific consent will be required. You will be contacted prior to this event taking place. Please note that photos and/or videos of school activities that are open to the general public may be taken and used for purposes within and outside of the school.
  
• the taking of photos/videos of classroom or other school activities by the school board where the material will be used within the school. Where individual students are identified or interviewed and the material will be used outside the school, a separate and specific consent will be required. You will be contacted prior to this event taking place.
  
• the use of students’ names on artwork or other creative work or material of students displayed at school or school board sites or at a school board sponsored display in the community, provided the attached copyright release form is properly completed. [Note that this relates to the Copyright Act (Canada), not the FOIP Act]

If you have any questions or concerns regarding the collection and the intended purposes, please contact title of person best able to answer inquiries, at business address, business telephone number.

This consent form is to be completed in the following circumstances:

• when interviews are undertaken or when photos or videos are taken by the media or an outside organization for non-public events for use outside the school community, when individual students are identified by name or face.
• when photos or videos are taken by the local board where individual students are identified and the material is to be used for purposes outside the school.

I hereby consent for name of student (if not an independent student) to be

• interviewed by
• photographed by
• videotaped by
• tape recorded by

name of organization (or school board department responsible for the activity)

Purpose of the interview, photograph or videotape and the use that will be made of it as follows:

Signed this _____ day of _______________, 200__

For further information please contact your school principal or the FOIP Coordinator at (address and phone number).

 The school has a School Council which represents the parents and engages in activities of the school. The school will normally make the parent/guardian name, phone number and mailing address as well as the student's name and grade level available to the School Council for contact purposes. I give permission for the release of the above information to the School Council.

Signed this _____ day of _______________, 200__

 

Sample Copyright Release Form

I hereby grant permission to Name of school/school board on behalf of my children, name of students, to (please check appropriate boxes)

• record and tape my child(ren)
• display any of my child(ren)'s works, and
• reproduce any of my child(ren)'s work

which are produced during the 200_/____ school year, for non-profit, educational purposes. I understand the production(s)/work(s) may be shown at education displays during board sponsored open houses, in-service sessions and other school related activities at school board sites or at school board sponsored displays in the community, or used in a school publication.

Signed this _____ day of _______________, 200__

Sample Francophone Education Eligibility Question

According to Section 10 of the School Act and Section 23 of the Canadian Charter of Rights and Freedoms the following applies:

Citizens of Canada

• whose first language learned and still understood is French, or
• who have received their primary school instruction in Canada in French
• have the right to have their children receive primary and secondary school instruction in French.

Citizens of Canada

• of whom any child has received or is receiving primary or secondary school instruction in French in Canada,
• have a right to have all their children receive primary and secondary instruction in the same language.

According to this criteria, are you eligible to have your child educated in French?

Yes   No

If yes, do you wish to exercise your right to have your child educated in French?

Yes   No

Note: This can be incorporated as part of the registration form.