Personal Information Protection Act

The Freedom of Information and Protection of Privacy Act (FOIPPA) regulates the collection, use and disclosure of personal information by public bodies like boards of education and francophone educational authorities.

The Personal Information Protection Act (PIPA) regulates the collection, use and disclosure of personal information by private organizations such as independent school authorities. It states that:

• Independent school authorities must not collect, use or disclose personal information without the consent of the individual (unless otherwise permitted under the Act).
• On or before collecting personal information about an individual from the individual, independent school authorities must disclose to the individual verbally or in writing the purposes for the collection and, on request, contact information.
• Independent school authorities may only collect, use or disclose personal information for the purposes that a reasonable person would consider appropriate in the circumstances and that fulfill the purposes the independent school disclosed or are otherwise permitted under the Act.

Complying with the Legislation

This means that independent school authorities must:

• Advise students, parents and employees what personal information is specifically being collected
• Be transparent about the use and disclosure of personal information
• Obtain consent for the collection, use and disclosure of personal information
• Only use and disclose the information in accordance with stated purposes

Students, parents and employees have the right to access their own personal information held by independent schools. The commissioner under PIPA can investigate complaints about how personal information is being handled. PIPA does not apply to information that was collected before it came into force.

In general, independent schools should assign a staff member or team to be responsible for creating and maintaining PIPA-specific policies and processes to be followed, inclduing a process for responding to complaints about compliance with PIPA. These should be made available to students, parents and employees. Consult with a legal advisor to determine best practices specific for your independent school.

Here are a few sample situations to consider:

• Monitoring employee or student internet use
• Collection, use and disclosure of employee or student medical records
• Employee access to evaluation in a job competition
• Handling complaints about misuse of employee or student information