Under the FIPPA, UBC must collect, use, and disclose personal information in a lawful and appropriate manner.
For instructors, the important thing to consider is that sensitive data—information about an identifiable individual, e.g. student biographical, financial, educational, and employment information—should not be:
- Distributed to or held on servers outside Canada (such as a learning technology located in the U.S.)
- Stored unencrypted on computers or mobile devices such as laptops, tablets, or smart phones
Additional info about FIPPA can be found on the University Counsel's website or the OIPC website. Specific information on using cloud services in compliant ways is available within the Privacy Fact Sheet: Disclosing Personal Information Outside Canada.
The Freedom of Information and Protection of Privacy Act (FIPPA) in BC requires that all information about our students remain in Canada to protect their privacy and identities. As educators, we may choose to use applications or tools that are hosted outside of Canada. We must be mindful that students' online activities may affect their personal and professional lives. We cannot require our students to use their personal accounts on non-Canadian-hosted services to meet the academic requirements of the course. Many tools and platforms, however have options for users to remain anonymous by the use of an alias. The Office of the University Counsel indicates that if use of the tool is required for a course, instructors need to seek consent from students and students must be given an option to use an alias.
The key questions to consider when thinking about incorporating cloud-based services into the learning environment are:
At UBC, learning technologies hosted outside Canada may be used under the following conditions:
- in the course description, or in a written communication to the students, describe the non-Canadian-hosted service and the information that it will be storing or accessing
- if the students choose not to provide their consent to this storage or access, they must see the instructor to make alternate arrangements
- make alternate arrangements for students who prefer not to provide their consent, such as allowing them to sign in to the service using a false name and non-identifying email address
You may also choose to link to resources for students that can help them make an informed decision about their digital presence.
SAMPLE COMMUNICATION TO STUDENTS:
In this course, students will be using (specify tool or platform), which is (specify what the tool is). This tool will help us (specify how students will be using the tool). During the account creation process, you will be required to provide your name and other identifying information. This tool is hosted on servers in (specify where). By using this service, you are consenting to storage of your information in (the location). If you choose not to provide your consent, see the instructor for alternate arrangements.
Resources for Students
In addition to protecting students' privacy, as educators, we are also responsible to role modeling and showing our students how we make decisions about our online activities. The Digital Tattoo Project highlights resources developed by students to help their peers make decisions about their online participation and identity formation:
An important aspect of ensuring that we are complying with FIPPA as we move to leverage a non-Canadian-hosted tool in our class is the need to document our attempts to ensure that all students are informed of the use of the tool, the reason for its use and the option to obfuscate their identity (through the use of an alias) or participate in another way, as required. These attempts may include:
- a copy of or link to our course description and syllabus, specifying the tool or platform to be used, potential learning benefits and where information is stored
- a copy or link to any other information provided to students about the use of the tool or platform
- for students using aliases, our list of their accounts and aliases
In the event a student complaint about a breach of privacy, these documents will be important to demonstrate that we have taken reasonable steps to comply with our obligations under FIPPA.
Note on the use of an alias: Instructors will need to read the terms of service for the tool we are thinking of using. Some services do not allow the use of aliases and will specify this in the terms/user agreements. In this case, we may want to explore other options for hosted UBC applications or pursue a Privacy Impact Assessment. At UBC, instructors can begin this consultation with the Learning Technology Hub.
Resources for Instructors
- UBC's Privacy Fact Sheet: Disclosing Personal Information Outside of Canada for examples of considerations related to the use of non-Canadian-hosted Services.
- Privacy Guide For Faculty Using 3rd Party Web Technology (Social Media) in Public Post Secondary Courses (2011): Vancouver Island University in collaboration with BCCampus
For more information/support, contact:
More About Privacy and Bill C-51
- Privacy Matters @ UBC
- Office of the University Council UBC: Protection of Privacy
- FIPPA: Freedom of Information and Protection of Privacy Law
- Privacy and Cyber Security - Emphasizing privacy protection in cyber security activities - a research report from the Office of the Privacy Commissioner of Canada (December, 2014)