Information and Privacy Commissioner Bob Clark today released Investigation Report 99-IR-002. The report concludes an investigation into a privacy complaint under section 51(2)(e) of the Freedom of Information and Protection of Privacy Act (the “FOIP Act”).
The Commissioner received a complaint that Edmonton Public Schools breached the privacy of grade six students by administering a questionnaire without obtaining the consent of parents/guardians.
Edmonton Public Schools asked students to complete a questionnaire as part of a study to identify factors that affect student achievement scores. The study was co-sponsored by: Edmonton Public Schools; another Public Body; a professional regulatory body and a researcher at a post-secondary institution.
The investigation found that Edmonton Public Schools had authority under section 32(c) of the FOIP Act to collect personal information for the purpose of the study. Section 32 allows public bodies to collect personal information if that information relates directly to and is necessary for an operating program or activity of the public body. The investigation found that collecting students’ opinions and views in a questionnaire about education-related matters is relevant and directly related to the activity of Edmonton Public Schools.
However, it was found that Edmonton Public Schools contravened section 33(2) of the FOIP Act by failing to provide parents/guardians with prior notification that their child would be asked to complete a questionnaire as part of the study. Section 33(2) of the FOIP Act requires that prior to collecting personal information public bodies must inform the individual of: (1) the purpose(s) the personal information will be used (2) the public body’s authority to collect the personal information and (3) the name, title and business phone number of an employee or officer of the public body who can answer questions about the collection.
The personal information collected in the questionnaire was disclosed by Edmonton Public Schools to a researcher at a post secondary institution for analysis and preparation of a report. The investigation found that, while a public body may release personal information for research purposes, it must comply with the provisions of Section 40. In this case, Edmonton Public Schools failed to follow Section 40 prior to disclosing the personal information. Despite this, it was found that measures were in place to protect the personal information from unauthorized disclosure and use.
The investigator recommended that Edmonton Public Schools:
- In future, comply with Sections 33(2), 38 and 40 of the FOIP Act
- Ensure a research agreement incorporating Section 40 of the FOIP Act is signed prior to information being collected, used or disclosed.
- Establish a destruction schedule for the personal information collected and
- Mitigate the failure to satisfy the requirements of Section 33(2) by sending a letter to parents of grade six students containing the information required to be supplied under that section.
The investigation found that Edmonton Public Schools responded promptly to the complaint by accepting responsibility for control of the personal information and for ensuring measures were in place to protect the personal information from unauthorized disclosure and use.
The investigation noted that when there are a number of organizations involved in a research project confusion can result with respect to which organization is responsible for protection of privacy and security of the personal information. It is important that public bodies involved in research projects ensure that they comply with the FOIP Act if they are collecting and/or disclosing personal information.