A news release on the resolution was issued on November 20, 2025.

The resolution is available on the website of the Office of the Privacy Commissioner of Canada:

Protecting the privacy of children and youth through responsible use of educational technologies in the classroom

November 2025

The following activity sheets and lessons plans are meant to be used by teachers and students in K-12 education:

• Social Smarts: Privacy, the Internet and You (external link)
• Social Smarts: Nothing Personal! (external link)
• Privacy Snakes and Ladders (PDF)
• Connect the Dots (PDF)
• Learning About Passwords / Colour the Tablet (PDF)
• Word Search (PDF)
• Kids’ Privacy Sweep (PDF)
• Know the Deal: The Value of Privacy (PDF)
• Getting the Toothpaste Back into the Tube: A Lesson on Online Information (PDF)
• Privacy Rights of Children and Teens (PDF)

The Freedom of Information and Protection of Privacy Act (FOIP Act) governs the collection, use and disclosure of personal information by public bodies. A public body includes a school board and charter school as defined in the Education Act (section 1(d) of the FOIP Act).

The Personal Information Protection Act (PIPA) applies to the collection, use and disclosure of personal information by provincially-regulated “organizations”, such as private schools, including those incorporated under Alberta’s Societies Act or registered under Part 9 of the Companies Act.

Under the FOIP Act and PIPA, personal information cannot be disclosed by public or private schools, except where authorized by the Acts. Even when authorized, such disclosures are discretionary – they enable the disclosure but they do not require it.

Personal Information

The Acts define personal information to mean “information about an identifiable individual” (section 1(n) of the FOIP Act; section 1(1)(k) of PIPA).

A student’s membership in a school club, such as a gay-straight alliance, is information about that student and is personal information to which the FOIP Act and PIPA apply.

Disclosure of Personal Information under the FOIP Act

Under the FOIP Act, personal information can only be disclosed in circumstances set out in the Act, including when:

• Disclosure would not be an unreasonable invasion of the individual’s personal privacy (section 40(1)(b))
• Disclosure will avert or minimize a risk of harm to the health or safety of a minor (section 40(1)(ee))
• Disclosure is authorized by another Act or regulation of Alberta or Canada (section 40(1)(f))
• Disclosure is to a public body or law enforcement agency in Canada to assist in an investigation undertaken with a view to a law enforcement proceeding (section 40(1)(q))
• The individual the information is about consents to the disclosure (section 40(1)(d))

Notwithstanding that a disclosure is authorized, a school may disclose personal information only to the extent necessary to enable it to carry out its purpose in a reasonable manner (section 40(4)).

Disclosure of Personal Information under PIPA

Under PIPA, personal information can only be disclosed with consent (section 7(1)(d)) or in circumstances set out in the Act, including when:

• A reasonable person would consider that the disclosure is clearly in the interests of the individual and consent cannot be obtained in a timely way or the individual would not reasonably be expected to withhold consent (section 20(a))
• Disclosure is authorized or required by another Act or regulation of Alberta or Canada (section 20(b))
• Disclosure is necessary to respond to an emergency that threatens the life, health or security of an individual or the public (section 20(g))
• Disclosure is reasonable for the purposes of an investigation or a legal proceeding (section 20(m))

Organizations can only disclose personal information for purposes that are reasonable, and only to the extent that is reasonable for meeting those purposes (section 19).

A school cannot require a student to consent to the disclosure of personal information beyond what is necessary (section 7(2)).

Mature Minors

Both the FOIP Act and PIPA give individuals certain rights and powers, including the ability to consent to the disclosure of personal information.

If a school is relying on consent to disclose personal information, it must consider whether the personal information is about a mature minor (i.e. a minor who understands the implications of giving consent such that a school would need the student’s consent and not that of the parent to disclose).

If an individual is a minor, that individual’s rights under the FOIP Act may be exercised by a guardian of the minor in circumstances where, in the opinion of the head of the public body, the exercise of the right or power by the guardian would not constitute an unreasonable invasion of the personal privacy of the minor (section 84(1)(e)).

PIPA allows for the rights set out in the Act to be exercised by an individual under the age of 18, if the individual understands the nature of the right or power and the consequences of exercising the right or power. If the individual is under 18 years of age but does not meet these criteria, the rights and powers may be exercised by the guardian of the individual.

Individuals, including students, should be made aware of their rights under the Acts. A guardian may be required to provide evidence of his or her authority to exercise the rights of a minor.

Making a Complaint to the Commissioner

If a student feels a school has improperly disclosed their personal information, the student can submit a complaint to the Information and Privacy Commissioner. The Commissioner can order that any inappropriate disclosure stop.

Information about how to submit a complaint to the Commissioner is available at www.oipc.ab.ca.

September 2019