Privacy is the right for individuals to control their own personal information. Personal information is recorded information about an identifiable individual which is not otherwise publicly available, such as:

• Name
• Personal address and telephone
• Social Insurance Number
• Personal email address
• Gender
• Age
• Religion
• Marital status
• Income
• Family status
• Health information
• Student number
• Education history (e.g. courses taken, grades, evaluations)
• Employment history
• Financial data (e.g. credit card information)

Since students attend university in a personal capacity rather than a business one, their names and all other information (including their ECU email addresses) would be considered “personal information”.

For current students, all information pertaining to their academic history is considered to be personal information and is treated as confidential by ECU.

While online educational tools and services (e.g., Google Docs, Dropbox, social media platforms) may be innovative, readily accessible and available at little or no cost, their use may pose privacy risks to students and to ECU.

Under s.30.1 of FIPPA legislation, disclosure, storage or access of student personal information outside of Canada is not permitted.

FIPPA does not prohibit you from using online tools in class. However, you cannot require a student to use a tool or service that stores their personal information outside of Canada – you must offer an alternative (e.g., using fake names or aliases or offering another FIPPA-compliant technology instead).

Before asking students to use a particular technology, instructors should consider the privacy risks and potential mitigation strategies. Ask yourself:

• Does the software collect personal information (e.g., student names, emails and coursework)?
• How much information will the student be required to provide (e.g., first and last name?)? Is it sensitive?
• Does the software store information outside of Canada? (Check their Terms & Conditions or Privacy Policy)
• Does the software use the information collected for secondary purposes (e.g., marketing)?
• Who has access and can see the information (is it a public comment forum with student names attached)?

Design your course requirements to minimize student privacy risks and make sure students are aware of their options (the more information the better). Provide a notification at the beginning of the semester in your course outline identifying which online educational tools will be used, their potential risks and alternatives available to the student.

Feel free to adapt this sample privacy messaging for your online course outline:

This course uses a variety of educational technology including internet-based technologies, cloud services and social media. The use of technology is part of your engagement at ECU in this course. Some of these learning tools may collect, use and/or disclose your personal information and store or access that information outside of Canada. Personal information is information about an identifiable individual, for example, your name or your email address.

The following educational technologies, which stores or accesses your personal information outside Canada, is required for this course: [LIST EDUCATIONAL TECHNOLOGIES REQUIRED]. I will make you aware if this list changes.

I use these technologies to enhance your educational experience. The personal information is required by the service. The privacy policy and the terms of use list the personal information stored outside of Canada and are available at [INCLUDE LINKS]. You are encouraged to read these documents.

If you are not comfortable with your personal information being stored outside of Canada, please speak to me within the first week of class about using an alternative (such as using an alias or nickname). Otherwise, by continuing in this course, you agree to the use of the educational technology in the course and the storage of personal information outside of Canada.