Ontario’s access and privacy legislation

What legislation applies to the privacy of, and access to, students’ personal information?

 

 The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)

MFIPPA sets out the rules that school boards and other municipal institutions must follow regarding the collection, use, retention and disclosure of personal information.1 MFIPPA also establishes a right for individuals to access and request corrections to their personal information, as well as to access general records held by school boards.

While the focus of this guide is on access to and privacy of students’ personal information, it is important to note that the rights and obligations set out in MFIPPA apply to any individual’s personal information. For example, where a school collects, uses or discloses information about a student’s parents, it must protect the privacy of this information.

The Education Act

The Education Act is the main law under which schools and school boards operate. It governs how education is delivered to students in Ontario’s publicly funded school system.2 The Education Act contains a number of sections relevant to access and privacy, including rules about access to and the collection, use and disclosure of information contained in the Ontario Student Record (OSR).

Other legislation

MFIPPA and the Education Act are the two main laws that guide access to information and privacy in Ontario’s public and separate schools. This guide also references other pieces of legislation, such as the Personal Health Information Protection Act (PHIPA), the Child, Youth and Family Services Act, and the Occupational Health and Safety Act. These laws also permit or require school boards to disclose limited personal information about students in certain situations. PHIPA sets out the rules for collection, use and disclosure of health information, and may apply when students receive health care in school, such as from a school psychologist or speech-language pathologist (See Collection, use and disclosure of health information).

 


1. Provincial and demonstration schools operated by the Ministry of Education, and the ministry itself, are governed by the provincial equivalent of MFIPPA, the Freedom of Information and Protection of Privacy Act (FIPPA). These two acts are very similar in terms of the rights and obligations they create. While references in this guide are to MFIPPA, in all cases similar provisions are found in FIPPA.
2. Private schools are not subject to either MFIPPA or FIPPA. Some private schools are covered by a federal privacy law called the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private sector organizations collect, use and disclose personal information in the course of commercial activity. More information is available from the federal Office of the Privacy Commissioner of Canada (www.priv.gc.ca), which has oversight over PIPEDA.