In order to follow best practices as recommended in the above
law, permission from parents and guardians will be required to post specific
personal information. Our student web pages attempt to preserve privacy of individuals
in the following ways:
1. Names are not associated with any individual student's photograph.
2. Group photos are given general captions without specific disclosure
of names.
3. Students taking part in school activities, such as school dances,
do not have their names associated with the photographs.
4. Students, when designing their own educational web sites, are
instructed to not include any family surnames or any
other personal information such as telephone numbers, email address or street
address. Photographs should not be named. On class indexes, nicknames or "aliases"
are used to help create some privacy as well.
5. Viscount Montgomery School's web policy is under constant review.
Your input and opinion is sought and valued. If you would like to comment, please
contact Mr. Brown.
Notes from the Act: Introduction
There is increasing interest amongst schools and school boards in creating their own Web sites as a way to support communication with their communities. In this context, Web sites can be utilized in many positive ways: highlighting initiatives and events; making available things such as policies, school profiles and course outlines; and providing links to educational sites.
But schools and school boards should exercise caution when posting information on Web sites. Information that may be relatively innocuous when hanging on the wall in a school corridor – such as a student’s name or photograph – may have serious privacy issues when posted on a Web site. This information, which can be downloaded and combined with other information, may result in a potentially significant invasion of privacy – and potentially lead to significant concerns about personal safety and security.
In creating Web sites, schools and school boards must be mindful of their obligations under the Municipal Freedom of Information and Protection of Privacy Act (the Act). First, they must consider the nature of the information they want to post on their Web sites and determine whether any of this information is “personal information.” If the information is personal information, then they must consider whether, by including this type of information on their Web sites, they are disclosing this personal information in accordance with the Act. In this regard, despite the possibility that other criteria under the Act might be considered to authorize such a disclosure, a best practice would entail only posting the personal information where consents have been obtained from all affected individuals or from a person who is legally authorized to consent on their behalf.
These best practices have been prepared jointly by the Office of the Information and Privacy Commissioner/Ontario, the Upper Grand District School Board and the Peterborough, Victoria, Northumberland and Clarington Catholic District School Board. Although these best practices focus on issues frequently dealt with by schools and school boards, other municipal institutions and provincial institutions can refer to these best practices for guidance when considering posting information to their Web sites.
Access and Privacy on the Internet: What has Changed?
For some time now, schools and school boards have been using newsletters and other print materials to communicate education-related information to parents and students.
Increasingly, schools and school boards are using the Internet to disseminate information to students, parents and the public at large.
The Internet challenges us to think about access and privacy in new ways. While it offers access to information at an unprecedented level and speed, the Internet can also threaten our privacy as never before. It is critical that we be aware of these challenges so that we are in a better position to maximize the benefits of the Internet and minimize any loss of privacy. There is a balance that must be struck between the free flow of information and the protection of personal privacy.
The Internet is in its infancy and is still not well understood by the average user. The same technology that can be used to make our lives easier can also become an intrusion. For example, search engines can scour more than a billion Web pages for pertinent information at the request of the user. By simply typing a student’s name into a search engine, a user can compile a profile of a student based on every indexed Web page. Depending on what the schools and school boards post on their Web sites, this profile may consist of information such as where the student attends school or the student’s extracurricular activities and schedules. When this information is combined, it can be used, for example, to pinpoint a student’s location at a particular time.
While parents may be proud of their child’s academic and extracurricular accomplishments, not every parent may be comfortable having their child’s achievements displayed on the school Web site. In the past, while students’ personal information may have been publicly available, that information may have been located in one place or a limited number of places. In this way, information, although publicly available, was not necessarily readily accessible to the world at large. This was the case, for example, with school yearbooks being kept in school libraries. By contrast, that same information, once posted to a Web site, can be viewed by anyone in the world with access to a computer. With the click of a mouse, the information could then be copied and manipulated. With this in mind, it is easy to see why there may be reason for concern in certain circumstances.
Role of Information and Privacy Co-ordinator
Awareness is key. It is important for Information and Privacy Co-ordinators to not only think critically about what is being posted to their Web sites, but also to make others in their institutions aware. The more time spent trying to understand the potential consequences at the outset, the less time and energy required to remedy unforeseen and often irreversible damage. As the school boards’ access and privacy professionals, Co-ordinators must become involved during the development stage of all Web site projects. The issues that Co-ordinators could bring forward include the following:
The collection, use, and disclosure of personal information must take place within the framework of the Act.
If the Web site requires or invites users to provide personal information, the school board must ensure that the Act authorizes collection of that information for the particular purpose. The school board must provide notice regarding the collection and its purpose, and ensure that the information is retained for the period specified by regulation or retention schedule. The school board should also ensure proper protection from unauthorized access, and make provision for access to one’s own information.
Consider the issue of disclosure of personal information. This issue may be particularly important with respect to posting records that may contain personal information (e.g., yearbooks, photographs, names of Ontario scholars). How could information be changed, combined or matched?
If individuals are offered online access to their own information, is there adequate protection from unauthorized access and from manipulation and alteration?
What Types of Information Should Schools and School Boards Post on their Web Sites?
