Are school boards limited in the amount or kind of personal information they may collect?

Yes. A school board may not collect personal information unless the collection is:

  • expressly authorized by law, or
  • necessary to the proper administration of a lawfully authorized activity7

This applies to all collections of personal information. It includes information that is not recorded, such as information collected orally, perhaps through an interview with the student or parents.8

Consent is absent from this list because under MFIPPA, consent is not a source of authority for the collection of personal information. This means that, even with consent from a student or their parents, school boards can only collect personal information if one of the above two situations applies.


Expressly authorized by law

The Education Act requires principals to collect information for inclusion in a record about the student.9 The information must be collected in accordance with the regulations and guidelines made under the Education Act.

Generally, the OSR Guideline permits the collection of information for purposes of educating students. Therefore, a collection of personal information for other purposes would not be authorized under the Education Act.

Other laws, such as the Anti-Racism Act, may expressly authorize a school board to collect personal information for other purposes.10


Necessary to the proper administration of a lawfully authorized activity

Even if a collection of personal information is not expressly authorized under the Education Act or other laws, it may be permitted if it is necessary to properly administer a lawfully authorized activity.

In order to satisfy this condition, the collection must be necessary – which means more than merely helpful – to the administration of an authorized activity.

For example, under the Education Act, school boards are responsible for promoting student achievement and well-being.11 If a board wants to collect personal information for the purpose of promoting student well-being through a student survey about bullying, the collection of personal information through the survey must be necessary to achieve this goal. Justification must be provided for all personal information that is collected.12


In IPC privacy report MC13-60, a person living next to a school complained to the IPC after the school installed a number of internal and external security cameras. The complainant was concerned the cameras were recording his personal information.

The IPC noted that the operation of a school is lawfully authorized under the Education Act, and this includes responsibility for the safety and security of students and property.

Given the theft and vandalism which had been occurring on school property, the IPC found that video surveillance inside school property was necessary for the proper administration of this lawfully authorized activity. However, the security cameras recording outside of the school property were not found to be necessary for this purpose.



7 MFIPPA, s. 28(2)
8 MFIPPA, s. 28(1)
9 Education Act, s. 265(1)(d)
10 The Anti-Racism Act, 2017 allows certain public sector organizations to collect and use personal information for the purpose of eliminating systemic racism and advancing equity, in compliance with that act and its accompanying data standards.
11 Education Act, s. 169.1(1)(a)
12 See Cash Converters Canada Inc. v. Oshawa (City), 2007 ONCA 502, and IPC Privacy Report MC07-68

This post is also available in: French