What is personal information?
Within the meaning of Quebec laws, just about all information concerning your students or your colleagues is personal information.
In fact, any information that relates to a natural person and allows that person to be identified is personal information.
Examples of Student Personal Information
- Phone number
- Social or family status
- Electronic address
- Digital identity (permanent code, student number…)
- Course registration
- Course options
- Course schedule
- Class attendance
- Academic results
- Accommodation measures
Information from a presentation [in French] by, from the law firm Chvatal Tremblay avocats, at the Fédération des cégeps, for Collecto.
A name by itself is not considered personal information. This means that if you simply have a loose list of names, there is no confidentiality issue. However, if this list is identified as being the list of your students enrolled in your course, or if this list is associated with student numbers or grades for a given assignment… then, it contains personal information and must be regarded as confidential.
If a student hands in an assignment with only their name written on it, and you add comments but no grades, it is okay. However, if the assignment includes a title page, for example, mentioning the course name, the course number, the student number, or if you write a grade on it, then you need to consider it as personal information and exercise caution in order to comply with the law.
If you have in your possession some personal information about your students, as part of your duties, you are responsible for storing them in a way to maintain confidentiality. This means you cannot share it with your colleagues unless it is necessary to perform their duties.
If you submit personal information on organization servers, you are responsible for it. Even businesses that must comply with Quebec laws might represent a risk if their practices are not transparent. The risk is even higher when these businesses operate in other jurisdictions where the protection of personal information is weaker than in Quebec. In every case, you need to assess the protection offered to your personal information when giving it to a third party.
It is therefore best to limit the use of digital platforms to those recommended by your institution.
What does the law say?
The Act respecting Access to documents held by public bodies and the Protection of personal information already provided for limits on how personal information can be collected by a public body (such as an educational institution) and used within the institution.
No person may, on behalf of a public body, collect personal information if it is not necessary for the exercise of the rights and powers of the body or the implementation of a program under its management.
Act respecting Access to documents held by public bodies and the Protection of personal information, section 64
Effective September 22, 2023, the Act respecting Access to documents held by public bodies and the Protection of personal information, will also specify, in section 65.1, that personal information may not be used within a public body except for the purposes for which it was collected, unless with the consent of the person to whom it relates. There are however some exceptions:
- when personal information is used for purposes consistent with the purposes for which it was collected
- when personal information is clearly used for the benefit of the person to whom it relates
- when personal information is necessary for the application of an Act in Québec
- when personal information is used for study, research or statistics purposes and is depersonalized. (Information is depersonalized when it cannot be used to identify the person to whom it relates. Let’s note that depersonalization goes beyond simple anonymization. In a small cohort, it might be easy to identify students without their names being released, based on their gender, age, ethnic origin, or other information.)
Student consent: a simple solution?
The law provided for the use of personal information for other purposes than the one it was initially collected if the student has consented. However, the concept of consent itself is well regulated by law.
Consent under this Act must be clear, free and informed and be given for specific purposes. It must be requested for each such purpose, in clear and simple language and separately from any other information provided to the person concerned.
The consent of a minor 14 years of age or over is given by the minor or by the person having parental authority.
Consent is valid only for the time necessary to achieve the purposes for which it was requested.
–Act to modernize legislative provisions as regards the protection of personal information modifying the Act respecting Access to documents held by public bodies and the Protection of personal information
The consent is not freely given if the person feels the need to give it to pass the course. For instance, if you want to give points for your students’ participation in a Facebook group (which requires having a Facebook account, hence, to provide their name and email address to Facebook), you cannot legitimize your practice by having your students sign a consent form. If they know refusing will have a negative impact on their grade, their consent is invalid since it was not freely given. Even beyond a summative evaluation context, if the use of a tool is essential to the completion of a learning activity, the student who wants to learn to pass the course will feel compelled to sign in to the platform.
Furthermore, your college or your program cannot have the students sign a “multi-purpose” form that would lead them to consent to the disclosure of their personal information on different platforms used for various purposes: the consent would be invalid if not given for a specific action.
It would be best to refer to the committee in charge of the protection of personal information in your college in order to obtain a consent form template and get your version approved. If your college does not offer a template, here is a sample consent form proposed by Verger in her presentation.