Privacy & Information Security Law Blog

Recently, the Office of the Privacy Commissioner of Canada (“OPC”) issued its 2017 Global Privacy Enforcement Network Sweep results (the “Report”), which focused on certain privacy practices of online educational tools and services targeted at classrooms. The OPC examined the privacy practices of two dozen educational websites and apps used by K-12 students. The “sweep” sought to replicate the consumer experience by interacting with the websites and apps, and recording the privacy practices and controls in place. The overarching theme of the Report is “user controls over personal information,” which the OPC further refined into four subthemes: (1) transparency, (2) consent, (3) age-appropriate collection and disclosure, and (4) deletion of personal information.

• Transparency. The OPC found that, although all of the websites and applications had privacy statements, only 78 percent were readily accessible at registration. The OPC underscored the importance of having clear and thorough descriptions of the organization’s privacy practices. The Report recommends as a best practice the “layered” approach, whereby organizations list short privacy statements that link to more detailed descriptions of how the organization processes personal information. The Report also recommends that organizations provide parents with printouts explaining their privacy practices.
• Consent. The Report highlights the importance of obtaining meaningful, age-appropriate consent from students or parents for the processing of students’ personal information, in accordance with the Personal Information and Electronic Documents Act (“PIPEDA”). Pursuant to PIPEDA, consent is valid only if it is reasonable to expect that the individual whose personal information is collected would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting. Accordingly, to obtain meaningful consent of children under the age of 13, PIPEDA requires the consent of a parent or guardian. For children aged 13 to the provincial age of majority, PIPEDA requires that the consent process be adapted to the child’s level of maturity. The Report found that many of the apps and websites reviewed did not have different consent mechanisms for younger and older students. The OPC highlighted as a best practice a mechanism that would send an email to parents with instructions for how to sign their under-13 child up for the service, and kid-friendly explanations of consent mechanisms for children over the age of 13. Additionally, the OPC found that more than a third of the apps and websites reviewed obtained only the consent of the teachers, and not the students or parents, in violation of PIPEDA.
• Age-Appropriate Collection and Disclosure of Personal Information. The OPC was particularly concerned with the amount of personal information collected about students by the websites and apps, as PIPEDA requires organizations to limit the collection of personal information to that which is necessary for the purposes identified by the organization. The Report notes that personal information can include categories such as student achievements and student-generated content. The Report advises website and app developers to (1) minimize the amount of data that is collected from students, particularly sensitive data (e.g., full name and date of birth); (2) limit non-essential uses of student data, particularly for younger students; (3) give teachers and parents the ability to set age-appropriate limits on the types of personal information students can upload and share; (4) limit disclosure of student data to third parties to what is necessary to provide the service; and (5) provide clear disclosures in the organization’s privacy policy.
• Deletion. The final area the Report focused on was the ability for users to request to have their personal information collected by the website or app deleted. Pursuant to PIPEDA, organizations must delete or anonymize personal information that is no longer required for the purpose for which it was collected. Over a third of the apps and websites reviewed by OPC did not have procedures in place to allow students or parents to delete students’ personal information. The Report recommends that websites and apps provide students and parents with a straightforward procedure to delete students’ personal information and implement and enforce data retention schedules.