- Download the Guide
- Ontario’s Access and Privacy Legislation
Collecting personal information
- Are school boards limited in the amount or kind of personal information they may collect?
- Does a school board need consent to collect personal information about a student?
- When can a school board collect personal information indirectly?
- Does a school board need to give notice that it is collecting personal information?
- What are the rules for collecting, using, disclosing and requiring the production of Ontario Education Numbers?
- Using and disclosing personal information
- Consent to collect, use and disclose personal information
- Safeguarding and retaining information
Access to information
- How do students and parents access personal information?
- Do individuals have a right to access general records from a school board?
- Do students need to reach a certain age before they can exercise their access rights?
- How does a child’s age affect the parent’s right of access to personal information?
- Do non-custodial parents have a right to access a child’s school records?
- Correction of Personal Information
- Special Topics
Are school boards limited in the amount or kind of personal information they may collect?
Yes. A school board may not collect personal information unless the collection is:
- expressly authorized by law, or
- necessary to the proper administration of a lawfully authorized activity7
This applies to all collections of personal information. It includes information that is not recorded, such as information collected orally, perhaps through an interview with the student or parents.8
Consent is absent from this list because under MFIPPA, consent is not a source of authority for the collection of personal information. This means that, even with consent from a student or their parents, school boards can only collect personal information if one of the above two situations applies.
Expressly authorized by law
The Education Act requires principals to collect information for inclusion in a record about the student.9 The information must be collected in accordance with the regulations and guidelines made under the Education Act.
Generally, the OSR Guideline permits the collection of information for purposes of educating students. Therefore, a collection of personal information for other purposes would not be authorized under the Education Act.
Necessary to the proper administration of a lawfully authorized activity
Even if a collection of personal information is not expressly authorized under the Education Act or other laws, it may be permitted if it is necessary to properly administer a lawfully authorized activity.
In order to satisfy this condition, the collection must be necessary – which means more than merely helpful – to the administration of an authorized activity.
For example, under the Education Act, school boards are responsible for promoting student achievement and well-being.11 If a board wants to collect personal information for the purpose of promoting student well-being through a student survey about bullying, the collection of personal information through the survey must be necessary to achieve this goal. Justification must be provided for all personal information that is collected.12
In IPC privacy report MC13-60, a person living next to a school complained to the IPC after the school installed a number of internal and external security cameras. The complainant was concerned the cameras were recording his personal information.
The IPC noted that the operation of a school is lawfully authorized under the Education Act, and this includes responsibility for the safety and security of students and property.
Given the theft and vandalism which had been occurring on school property, the IPC found that video surveillance inside school property was necessary for the proper administration of this lawfully authorized activity. However, the security cameras recording outside of the school property were not found to be necessary for this purpose.
7 MFIPPA, s. 28(2)
8 MFIPPA, s. 28(1)
9 Education Act, s. 265(1)(d)
10 The Anti-Racism Act, 2017 allows certain public sector organizations to collect and use personal information for the purpose of eliminating systemic racism and advancing equity, in compliance with that act and its accompanying data standards.
This post is also available in: French