IPC concludes investigation into school board’s use of cloud-based data service

The Office of the Information and Privacy Commissioner of Ontario (IPC) has concluded its investigation into the York Region District School Board’s (YRDSB) use of Edsby, a cloud-based data management service.

Edsby, an application that stores and processes student information, is used by the YRDSB under contract with vendor CoreFour Inc. to manage student attendance. The IPC’s investigation parallels an investigation by the Office of the Privacy Commissioner of Canada (OPC) into CoreFour’s practices.

The information collected by Edsby, on behalf of the YRDSB, includes student names, pictures, grade level, teachers, contact information, and attendance information. The IPC found the YRDSB’s use of the Edsby service to manage student attendance complies with Ontario’s municipal privacy law. The YRDSB’s contract with CoreFour also contained reasonable contractual measures to protect the privacy and security of the personal information of its students. However, the board fell short in taking steps to oversee the performance of CoreFour’s security obligations under the contract. The IPC report details the steps the board should take to strengthen and document its oversight of the security measures.

The IPC’s investigation report provides essential guidance to school boards that retain technology service providers to help deliver their education mandates and includes a discussion of the types of security provisions that should be included in their contracts. It also serves as a reminder that boards must complement a strong contract with appropriate monitoring and oversight to fulfill their obligations to protect student privacy.

Children and Youth in a Digital World is one of four strategic priorities the IPC has selected to guide its efforts now and into the future. The goal of this priority is to champion the access and privacy rights of Ontario’s children and youth by promoting their digital literacy and expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.