FIPPA — Privacy of Student Info

Maintaining Privacy of personal information while using Web Technologies

Fac­ul­ty Resources

• Fac­ul­ty Pri­va­cy Guide for Using Tools and Tech­nolo­gies Out­side Cana­da: BCcam­pus Link or PDF
• Blank Con­sent Form: Word Doc­u­ment
• Pri­va­cy Flow­chart: PDF
• Text­book Con­sent Form Tem­plate: Word Doc­u­ment
• Copy of this page PDF

Pro­tect­ing the Pri­va­cy of Stu­dent Data: Required Actions for Com­pli­ance with BC’s FIPPA Law

British Colum­bia (BC) has one of the strictest pri­va­cy laws of per­son­al data in North Amer­i­ca. It exists to ensure BC cit­i­zens are pro­tect­ed when it comes to stor­age and access of per­son­al iden­ti­fi­able infor­ma­tion. The Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) which came into effect in May of 2016 is anoth­er exam­ple of a strict pri­va­cy reg­u­la­tion on data pro­tec­tion and pri­va­cy for the Euro­pean Union (EU) and the trans­fer of data out­side of the EU.

To abide by BC’s Free­dom of Infor­ma­tion and Pri­va­cy Pro­tec­tion Act (FIPPA) Reg­u­la­tion, fac­ul­ty mem­bers and instruc­tors must deploy three prin­ci­ples when in sit­u­a­tions about pri­va­cy of stu­dent infor­ma­tion:

1. give notice to stu­dents when they are sending/requiring them to send their data to a loca­tion out­side of Cana­da
2. pro­vide knowl­edge of why they are doing this, and if required
3. obtain writ­ten con­sent from stu­dents for doing so. You can apply these prin­ci­ples to almost any pri­va­cy sit­u­a­tion to show you have done your due dili­gence

Writ­ten con­sent is the high­est lev­el of ‘due dili­gence’ when class­room work requires the use of social media, or when a fac­ul­ty mem­ber or stu­dent for­wards email to Gmail/Hotmail (web email ser­vices), and when a course requires the use of online text­books or text­book web­sites for doing activ­i­ties and test­ing of knowl­edge. Edu­cat­ing stu­dents is an impor­tant part of main­tain­ing their pri­va­cy.

It is the respon­si­bil­i­ty of indi­vid­ual fac­ul­ty mem­bers to ensure that they are com­pli­ant with FIPPA reg­u­la­tions. The fol­low­ing infor­ma­tion is pro­vid­ed to help ensure that fac­ul­ty mem­bers are aware of their respon­si­bil­i­ties.

When to Think About FIPPA

Any time stu­dents’ per­son­al, iden­ti­fi­able infor­ma­tion (first name, last name, date of birth, course stu­dent is enrolled in, stu­dent grades, home address, stu­dent Insti­tu­tion­al ID) is stored on a serv­er out­side of Cana­da, or the par­ent com­pa­ny that owns the serv­er is locat­ed out­side of Cana­da, stu­dents must be pro­vid­ed with notice, knowl­edge, and con­sent. Per­son­al, iden­ti­fi­able infor­ma­tion includes any infor­ma­tion that can be used to iden­ti­fy an indi­vid­ual stu­dent includ­ing pho­tographs, file names of doc­u­ments, stu­dent assign­ment titles, videos, audio files etc.

Instruc­tor Emails

Any email that con­tains student’s per­son­al, iden­ti­fi­able infor­ma­tion should ONLY be accessed from Cana­di­an-based ser­vices, such as NIC Out­look email account (host­ed at NIC). Ser­vices such as Gmail, Hot­mail, Yahoo, etc., host their ser­vices out­side of Cana­da (on servers around the world), and should not be used to access emails that con­tain stu­dent per­son­al iden­ti­fi­able infor­ma­tion (includ­ing access­ing NIC web­mail from a pub­lic com­put­er in anoth­er coun­try). This would be a vio­la­tion of the FIPPA reg­u­la­tion.

Online Text­book Resources

Any online learn­ing resource, such as text­books or any sup­port­ing mate­ri­als includ­ed in text­books (labs, quizzes, resources to access), that fac­ul­ty require stu­dents to use should only be host­ed in Cana­da. If the resource is locat­ed out­side of Cana­da, or the par­ent com­pa­ny is locat­ed out­side of Cana­da, fac­ul­ty must ensure they give stu­dents notice of infor­ma­tion that will be stored out­side of Cana­da, knowl­edge of why they need to access the site, and ensures there is stu­dent con­sent (writ­ten or some alter­na­tive form of record­ing con­sent such as a 1‑question quiz). In this way, stu­dents are made aware of the impli­ca­tions of hav­ing their data reside out­side of Cana­da and what oth­er com­pa­nies can do with their data.

Social Media, Web Tools and Online Tech­nol­o­gy Used in the Class­room

Many stu­dents access social media and var­i­ous web tools out­side of the class­room. What stu­dents do with social media out­side of the class­room on their own is their busi­ness, and not the respon­si­bil­i­ty of fac­ul­ty. If stu­dents are required to use social media, web tools or online tech­nol­o­gy resources as part of their class­es (make a Prezi, post to Twit­ter, cre­ate a Face­book account, upload video to YouTube, respond to a sur­vey with per­son­al data etc.), and that tool is based out­side of Cana­da (which almost every com­pa­ny is), fac­ul­ty are respon­si­ble to ensure they give stu­dents notice of infor­ma­tion that will be stored out­side of Cana­da, knowl­edge of why they need to access the tool and how it is impact­ed by BC FIPPA laws, and cap­ture stu­dent con­sent (writ­ten or some dig­i­tal form of record­ing con­sent that the instruc­tor keeps for up to 2 years).

Obtain­ing Stu­dent Con­sent

1. Look at the fine print for the resource, activ­i­ty or web­site you are requir­ing stu­dents to use in their class­es (remem­ber if it is an option­al assignment/activity and they can use oth­er tools not host­ed online out­side of Cana­da — you are fine). Read the pri­va­cy pol­i­cy: what data does the resource cap­ture? where does the data live? what alter­na­tives are there? how much data is required to be cap­tured?
2. Once you have all the infor­ma­tion, cre­ate a con­sent form for your stu­dents. A con­sent form is required FOR EACH COURSE clear­ly out­lin­ing the assign­ments, activ­i­ties and required learn­ing that makes use of a tool or resource that is putting stu­dent infor­ma­tion on servers out­side of Cana­da. Unfor­tu­nate­ly, you can’t have a ‘blan­ket’ pro­gram or degree con­sent form. You need the details for each course assignment/activity spelled out on its own con­sent form.
3. There is sam­ple NIC Con­sent Form for an Online Text­book Site for you to acquire from the Cen­tre for Teach­ing and Learn­ing Inno­va­tion, edit and use with stu­dents. Ensure you remove all ‘sam­ple’ con­tent and insert your own infor­ma­tion. There is also a blank NIC Con­sent Form for any­thing oth­er than online text­books that require stu­dent con­sent.
4. You are also able to cre­ate a ‘dig­i­tal con­sent form’ through an online con­tent page in Bright­space where stu­dents read and select their response to a ques­tion (con­sent) so you have record of their consent/non con­sent. Con­sid­er using a test on the first page with no marks to record respons­es to a con­sent ques­tion in Bright­space
5. If you wish some assis­tance to proof­read your con­sent form or you have ques­tions, kind­ly email the Cen­tre for Teach­ing and Learn­ing Inno­va­tion CTLI@nic.bc.ca for assis­tance.

Alter­na­tives to Stu­dent Con­sent

1. Research the tech­nol­o­gy and your assignment/task to ascer­tain if your students/you require the col­lec­tion, upload, and use of per­son­al iden­ti­fi­able infor­ma­tion (often you may not and can use the social media or web tool with­out need­ing such infor­ma­tion). You may be able to have stu­dents skip sec­tions intend­ed to cap­ture per­son­al iden­ti­fi­able infor­ma­tion.
2. If you or the web tool requires per­son­al iden­ti­fi­able infor­ma­tion – find out how much your stu­dents real­ly need to sup­ply (or are con­nect­ed to through accounts) and what are the pri­va­cy risks or abil­i­ties to make more pri­vate infor­ma­tion – then use a con­sent form.
3. If a stu­dent refus­es con­sent – have a Plan B. Some stu­dents, who do not want to engage in pri­va­cy-laden activ­i­ties, should have an alter­na­tive that ful­fils a lot of the main learn­ing inten­tions, but doesn’t expose them to pri­va­cy risks (e.g., use learn­ing man­age­ment sys­tem – Bright­space etc.)
4. Inquire about ‘on site’ or ‘Cana­di­an-host­ed’ tools that may allow you to do sim­i­lar activ­i­ties but not have to use US servers for stor­age, host­ing and access.
5. Edu­cate stu­dents – let them know what is going on. They may have some solu­tions!
6. Try using pseu­do­nyms for some social media ele­ments that won’t expose per­son­al iden­ti­fi­able infor­ma­tion.

Adapt­ed from orig­i­nal ver­sion from Van­cou­ver Island Uni­ver­si­ty writ­ten by L. Knaack and oth­er mem­bers of the Cen­tre for Inno­va­tion and Excel­lence in Learn­ing