Do your Practices Respect the Act on the Protection of Personal Information?

Did you know that:

• Using Google Docs or Google Sheets to store the list of students enrolled in one of your classes, from your personal Google Drive account, probably violates the law?
• Asking your students to join a Facebook group for a course might be illegal?
• Sharing the grades of your students with the other members of your department is illegal if their consent was not unequivocal and freely given for this specific action?

Surprised?

The Act to modernize legislative provisions as regards the protection of personal information (Bill 25) [in French] modifies the Act respecting Access to documents held by public bodies and the Protection of personal information.

This Act became effective on September 21, 2021, but it will fully come into force in September 2023. Certain provisions apply since September 2022 [in French].

This Quebec Act defines the obligations of public bodies concerning the protection of personal information. Therefore, this Act applies to colleges and governmental institutions (such as conservatories) and to their employees, including teaching staff. A similar Act applies to institutions in the private sector. Be prepared! What follows might encourage you to question some of your practices!

What is personal information?

Within the meaning of Quebec laws, just about all information concerning your students or your colleagues is personal information.

In fact, any information that relates to a natural person and allows that person to be identified is personal information.

Examples of Student Personal Information

Information from a presentation [in French] by, from the law firm Chvatal Tremblay avocats, at the Fédération des cégeps, for Collecto.

A name by itself is not considered personal information. This means that if you simply have a loose list of names, there is no confidentiality issue. However, if this list is identified as being the list of your students enrolled in your course, or if this list is associated with student numbers or grades for a given assignment… then, it contains personal information and must be regarded as confidential.

If a student hands in an assignment with only their name written on it, and you add comments but no grades, it is okay. However, if the assignment includes a title page, for example, mentioning the course name, the course number, the student number, or if you write a grade on it, then you need to consider it as personal information and exercise caution in order to comply with the law.

If you have in your possession some personal information about your students, as part of your duties, you are responsible for storing them in a way to maintain confidentiality. This means you cannot share it with your colleagues unless it is necessary to perform their duties.

If you submit personal information on organization servers, you are responsible for it. Even businesses that must comply with Quebec laws might represent a risk if their practices are not transparent. The risk is even higher when these businesses operate in other jurisdictions where the protection of personal information is weaker than in Quebec. In every case, you need to assess the protection offered to your personal information when giving it to a third party.

It is therefore best to limit the use of digital platforms to those recommended by your institution.

What does the law say?

The Act respecting Access to documents held by public bodies and the Protection of personal information already provided for limits on how personal information can be collected by a public body (such as an educational institution) and used within the institution.

No person may, on behalf of a public body, collect personal information if it is not necessary for the exercise of the rights and powers of the body or the implementation of a program under its management.

Act respecting Access to documents held by public bodies and the Protection of personal information, section 64

Effective September 22, 2023, the Act respecting Access to documents held by public bodies and the Protection of personal information, will also specify, in section 65.1, that personal information may not be used within a public body except for the purposes for which it was collected, unless with the consent of the person to whom it relates. There are however some exceptions:

• when personal information is used for purposes consistent with the purposes for which it was collected
• when personal information is clearly used for the benefit of the person to whom it relates
• when personal information is necessary for the application of an Act in Québec
• when personal information is used for study, research or statistics purposes and is depersonalized. (Information is depersonalized when it cannot be used to identify the person to whom it relates. Let’s note that depersonalization goes beyond simple anonymization. In a small cohort, it might be easy to identify students without their names being released, based on their gender, age, ethnic origin, or other information.)

Student consent: a simple solution?

The law provided for the use of personal information for other purposes than the one it was initially collected if the student has consented. However, the concept of consent itself is well regulated by law.

Consent under this Act must be clear, free and informed and be given for specific purposes. It must be requested for each such purpose, in clear and simple language and separately from any other information provided to the person concerned.

[…]

The consent of a minor 14 years of age or over is given by the minor or by the person having parental authority.

Consent is valid only for the time necessary to achieve the purposes for which it was requested.

–Act to modernize legislative provisions as regards the protection of personal information modifying the Act respecting Access to documents held by public bodies and the Protection of personal information

The consent is not freely given if the person feels the need to give it to pass the course. For instance, if you want to give points for your students’ participation in a Facebook group (which requires having a Facebook account, hence, to provide their name and email address to Facebook), you cannot legitimize your practice by having your students sign a consent form. If they know refusing will have a negative impact on their grade, their consent is invalid since it was not freely given. Even beyond a summative evaluation context, if the use of a tool is essential to the completion of a learning activity, the student who wants to learn to pass the course will feel compelled to sign in to the platform.

Furthermore, your college or your program cannot have the students sign a “multi-purpose” form that would lead them to consent to the disclosure of their personal information on different platforms used for various purposes: the consent would be invalid if not given for a specific action.

If you decide to seek your students’ consent to share or use their personal information for a new purpose in a particular context, do it in writing. (A consent obtained orally may be valid, but it is more difficult to prove afterwards if a problem occurs.) The form has to be very clear (not like those long terms of use agreement forms, as we often see). Someone has to be available to answer any questions from the person whose consent you ask.

It would be best to refer to the committee in charge of the protection of personal information in your college in order to obtain a consent form template and get your version approved. If your college does not offer a template, here is a sample consent form proposed by Verger in her presentation.

It must be understood that clear, free and informed consent is an exception, in its legal sense. Therefore, obtaining the consent of students to take action cannot be a substitute for compliance with the spirit of the law.

Information used “for the benefit of the person to whom it relates”?

The law provides for the possible use of personal information for another purpose than the one for which it was collected, if it is used “for the benefit of the person to whom it relates”. Does that mean that from the moment that we have good intentions toward a student, we can use their personal information without restriction? No.

Regarding the application of this provision, there is very little case law in a context of interest to us. However, the more sensible attitude is to adopt a cautious approach. If by wanting to help a student, you share their personal information with a third party and this sharing has or could have negative consequences for the student, you do not act for their benefit.

Discussing students with a colleague to support their success?

A colleague who taught during the 1^st semester sends you the list of students who had been less successful, so you can offer specific support in your 2^nd-semester course? The intention is good, but the practice is illegal. Indeed, since there would be other ways to provide support to students with special needs (for example, by evaluating the students with a diagnostic assesment at the beginning of the semester), the sharing of students’ personal information is not legitimate. (In addition, diagnostic assessment would have the advantage of giving the students control over their destiny instead of labelling them.)

During a department meaning, you mention a student who is failing in order to know how things are going in their other courses? Also illegal.

Good practices

• Select tools recommended by your institutions. Bill 25 stipulates that within every public body (so in every college and private subsidized college), a committee on access to information and the protection of personal information has been established since September 22, 2022. This committee is in charge of supporting staff in carrying out their responsibilities. Contact the committee members in your college to find out more!
• If you want to use digital tools different from the ones provided by your institution:
  • Do not force the students to use a specific tool; present them with various options.
  • Choose tools or applications that do not require an account to be created by the student or student authentication. There are several tools that students can access anonymously, for example via a digital code provided by the teacher.
  • Talk about the situation with your students, in order to give them the tools to make their own decisions.
• Do not discuss your students’ personal matters with your colleagues, unless given the student’s clear consent to do so. (As always, you can obviously ask for some advice from colleagues on the best way to help a student in a difficult situation. However, do not name the student and do not provide information that would allow your colleagues to identify the student in question.)

Our commitment

In order to support good practices in the subject matter, the Eductive team is committed to remaining vigilant when suggesting digital tools or presenting their applications to teachers in the future.

Do you have good practices on the protection of students’ personal information to share with our readers? Contact us, or let us know in the comments section!