Our goal is to champion the access and privacy rights of Ontario’s children and youth by promoting their digital literacy and the expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.
Photographs are often taken of students, in many cases by professional photographers, at the school’s request. Any photograph of one or more identifiable individual(s) is considered to be personal information.
Schools are permitted to collect personal information, including photographs, where it is necessary to the proper administration of a lawfully authorized activity.92 The collection of student photographs is considered necessary to the operation of a school (a lawfully authorized activity under the Education Act) because, for example, photographs enable staff to identify students.
Are schools required to give notice when photographs are taken?
Yes, a school must give notice if photographs of its students are taken by employees or anyone else working for the school, which may include contractors hired by the school and volunteers.93 The school can provide notice in a variety of ways, including on the school’s website, by email, regular mail, or in the student handbook (see Does a school board need to give notice that it is collecting personal information?).
What are the school’s responsibilities if it uses a professional photographer to take photographs?
If a school board uses a professional photographer, the board is still ultimately responsible for the security and confidentiality of its students’ personal information.94 Any service agreements with vendors must align with the provisions of MFIPPA. Their contracts should clearly describe the administrative, physical and technical safeguards to protect personal information (see How do school boards safeguard records).
In IPC privacy reports MC16-4 and MC16-5, the IPC found that schools are permitted to disclose limited personal information of students to a professional photographer for administrative purposes.
The IPC also concluded that disclosure for limited marketing-related purposes was permitted because it could be reasonably expected that a student’s personal information would be disclosed to the photographer for the purpose of offering parents the opportunity to purchase their children’s school photographs. However, parents/guardians should be given the choice to opt out of receiving marketing materials.
What about photographs taken by people who are not employed by the school?
Individuals not employed by the school may not be subject to MFIPPA. However, given that schools and school boards control who has access to school property, they are ultimately responsible for the safety and security of their students and the security and confidentiality of the students’ personal information, including their image.
In some instances, parents and students take photographs at sporting events, school concerts and other functions, and these photos appear in the school newsletter or in photo displays. On occasion, the media or researchers may request permission to photograph within the school setting. In these situations, the school board must notify students and their parents or guardians and get their consent.
Schools should develop a policy regarding photography of students on school property or at school events by non-school employees. The policy should be developed in consultation with parents and guardians and communicated to them and to teachers. These policies should apply to all images, including photographs, web postings, film and video recordings.
When can a school board use a student’s personal information?
School boards are not permitted to use a student’s personal information unless certain conditions apply.24 Under MFIPPA, school boards may only use personal information:
for the purpose for which it was collected, or for a consistent purpose
A consistent purpose is one which the parent or student would reasonably expect, such as using the information for the improvement of instruction of the student
with consent
for a purpose for which the information may be disclosed to the school board under MFIPPA. For example, if another institution disclosed information to the school board in a situation affecting an individual’s safety, the school board may use the information for this purpose.25
In IPC privacy report MI16-3, the IPC considered a teacher’s use of information regarding the identity of students who had Individual Education Plans, to solicit investment business through the sale of Registered Disability Savings Plans.
The information was originally collected by the school board for the purpose of educating students. The IPC found that the teacher’s use of the information to solicit investment business was not consistent with the purpose of educating students, and did not comply with MFIPPA.
The Education Act states that the OSR is available only for the information and use of supervisory officers and for principals, teachers and designated early childhood educators of the school, to improve the instruction and other education of the student. The act sets out a few additional circumstances in which principals and others may use the OSR, which include:
to prepare reports required by the Education Act, or, on request by a student’s parents (or an adult student), a report related to an application for education or employment28
Today, Canada’s federal, provincial and territorial privacy authorities jointly released a set of lesson plans designed for educators to teach students about privacy rights, digital literacy and online safety. These publications support a resolution by international privacy regulators calling for more privacy education in schools and training opportunities for educators.
Developed by MediaSmarts, a not-for-profit organization that promotes digital and media literacy, these lesson plans will help educators teach students about privacy rights and navigating the digital environment safely.
Navigating the online world safely can be a challenge. Young people need to be able to harness the full potential of online resources while protecting their privacy and themselves. Our schools must make privacy education a priority so that children are informed and empowered at an early age.
Those who learn to control their personal information and protect their online presence will be able to gain the skills and competence to participate effectively in the online economy and community.
The lesson plans released today come in three modules:
These modules include privacy principles that every student needs to understand, and lessons on how to:
identify what constitutes personal information
understand the technical and economic aspects of the digital environment
limit disclosure of personal information
protect oneself online
exercise one’s privacy rights
We encourage educators to download these lesson plans and put them to use so that future generations can participate safely and meaningfully in our increasingly online world. We also encourage teachers to contact us should they have any questions about Ontario’s access and privacy laws.
