School boards must give notice when a student’s personal digital information will be disclosed to a third-party software provider, and the notice must be in writing.
CONTENTS 1. Definitions 2. Prescribed school boards 3. Personal digital information 4. Notice of disclosure, information re individual under 16 years old 5. Notice of disclosure, information re individual 16 years old or older, under 18 years old 6. Form, format of notice Definitions 1. In this Regulation, “personal digital information” means personal information within the meaning of subsection 2 (1) of the Municipal Freedom of Information and Protection of Privacy Act that is in a digital format; (“renseignements numériques personnels”) “prescribed school board” means a school board prescribed by section 2; (“conseil scolaire prescrit”) “school year” has the same meaning as in the Education Act; (“année scolaire”) “software application” means any free or paid digital product or service, including a bundle of connected products or services that are designed to work together, that runs on an operating system. (“application logicielle”) Prescribed school boards 2. Every school board is a prescribed school board for the purposes of section 9 of the Act. Personal digital information 3. Personal digital information is prescribed digital information for the purposes of clause 9 (a) of the Act. Notice of disclosure, information re individual under 16 years old 4. (1) This section applies if personal digital information about an individual under the age of 16 who is enrolled in a school of a school board will be disclosed to a third party owner or operator of a software application that is, (a) used by the school board to carry out its legislated duties under the Education Act; or (b) purchased or otherwise acquired by the school board for use by individuals under the age of 16. (2) The school board shall give notice to the parent or guardian of the individual of the following: 1. The specific elements of personal digital information that will be disclosed. 2. The legal authority upon which the personal digital information will be disclosed. 3. The purpose for which the personal digital information will be disclosed. 4. The name of the software application and the third party owner or operator. 5. The title, email, business address and business telephone number of an individual authorized by the school board to answer questions about the disclosure of the information. 6. A statement explaining the rights of an individual under the age of 16 who thinks their personal digital information has been improperly collected, used, retained or disclosed and the rights of a parent or guardian of such an individual who thinks their child’s personal digital information has been improperly collected, used, retained or disclosed. (3) The notice mentioned in subsection (2) shall be given in accordance with the following rules: 1. If the school board is aware that the personal digital information will be disclosed to a third party owner or operator of a software application during a school year, the notice shall be provided in respect of the disclosure as early in the school year as is operationally feasible. 2. If the school board is aware that the personal digital information will be disclosed to a third party owner or operator of a software application at any time other than during a school year, the notice shall be provided in respect of the disclosure as soon as is operationally feasible for the school board to do so. 3. If the individual’s enrolment in a school of the school board ceases during a school year for any reason, the school board shall, as soon as is operationally feasible, upon request by a parent or guardian of the individual during the school year, give notice of disclosure of the individual’s personal digital information that occurred during the school year up until the enrolment ceased. Notice of disclosure, information re individual 16 years old or older, under 18 years old 5. (1) This section applies if personal digital information about an individual aged 16 years or older but under age 18 who is enrolled in a school of a school board will be disclosed to a third party owner or operator of a software application that is, (a) used by the school board to carry out its legislated duties under the Education Act; or (b) purchased or otherwise acquired by the school board for use by individuals in that age group. (2) The school board shall notify the individual of the following: 1. The information set out in paragraphs 1 to 5 of subsection 4 (2). 2. A statement explaining the rights of an individual who thinks their personal digital information has been improperly collected, used, retained or disclosed. (3) The notice mentioned in subsection (2) shall be given in accordance with the following rules: 1. The rules set out in paragraphs 1 and 2 of subsection 4 (3). 2. The rule set out in paragraph 3 of subsection 4 (3), except that the notice shall be given upon request by the individual instead of a parent or guardian of the individual. Form, format of notice 6. Notice required under this Regulation shall be provided in writing and may be provided in an electronic format. 7. Omitted (provides for coming into force of provisions of this Regulation).