4.16 Privacy Laws

Federal and provincial laws govern the collection, use, and storage of personal information. Canada has two federal privacy laws: the Privacy Act, which pertains to information collected by government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), which over-sees information collected by organizations in the private sector. As well, each province has guidelines to protect information held by government institutions and agencies, of which school divisions are a part. Provincial privacy laws may be health-related or employment-related, and there also exist some sector-specific privacy laws such as the Bank Act that regulate financial institutions or deal with credit reporting.

As agents of the state, teachers and administrators must be very careful to protect the personal information of the students, employees, and families with whom they work. Report card data, student and personnel records, student pictures, website information and now computer and cellular phone data must be handled very carefully in order to protect the privacy (and sometimes safety) of those who are connected to the school. An interim decision made by the Information and Privacy Commissioner of Ontario (IPC) was based on the Toronto Catholic District School Board’s refusal to provide access to a student’s request for sensitive information (Annual Review of Education Law, 2018). The information request was made by a student and his mother in relation to an allegation of his gang involvement and threats made to another student. The board did not grant access to threat assessment documents and investigation notes on the basis that information in the records could invade the privacy of other individuals whose personal details were included in the records, or who could be identified, leading to significant personal distress. The IPC found that due to the context, redaction of names would not protect identities of individuals involved, and disclosure of information could lead to personal distress of students, or risk of harm to the threat assessment team. Only information related to the student’s own statements or information about his mother was ordered to be shared.