Commissioner reviews school division’s approach to privacy and access to information issues

Posted on 23 March 2022 by Matthew Liebenberg

The Chinook School Division’s approach to privacy and access to information issues came under the spotlight as a result of an investigation by the Saskatchewan Information and Privacy Commissioner (SIPC).

The details of an investigation and two reports with various recommendations to the Chinook School Division were released by the office of the SIPC, March 1.

The SIPC investigation was the result of a complaint received by the parent of a student in the Chinook School Division.

The parent, referred to as the applicant in the reports, initially contacted the SIPC in August 2020 about access to information requests made to the Chinook School Division. The parent also asked the SIPC in November 2020 to investigate a privacy complaint.

The SIPC reviewed both requests from the applicant and found it had jurisdiction to proceed with an investigation.

The parent originally made an access to information request to the Chinook School Division after a meeting with a principal, vice-principal and two superintendents of the school division in January 2020. She was given a school handbook during this meeting and later found a copy of an e-mail inside this document.

This e-mail was a message from a superintendent of schools to the principal and included a reference to the parent. She therefore made an access to information request to the school division to request copies of all e-mails between staff and officials that included her name or her child’s name.

The school division provided her access to some of the records, but denied access to some records in part or in full in accordance with the requirements of certain sections of the Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP).

The SIPC carried out a detailed investigation into the school division’s approach to deny access to certain records. Commissioner Ron Kruzeniski concluded in his findings that “the Chinook School Division has not demonstrated it made a reasonable effort to search for records responsive to the Applicant’s access request.”

He therefore recommended that the school division conducts another search for records within 30 days of the release of his report, and that the school division provides his office and the applicant with the details and results of this additional search effort.

His report includes a lengthy appendix with an analysis of the school division’s decision to withheld 202 records in part or in full from the parent. The analysis for each record indicates the commissioner’s recommendation on whether information can be released to the parent or not in accordance with LA FOIP.

The commissioner’s second investigation reviewed the parent’s privacy complaint against the Chinook School Division.

This complaint was the result of a consent form completed by the parent during her meeting with school division officials in January 2020. She listed five staff members as persons who could provide and/or exchange information. She sent an e-mail to these five staff members a few days later and indicated she is comfortable sharing confidential information about her child with them.

Her e-mail was subsequently sent to other senior Chinook School Division staff. Other e-mails by the parent were also shared with senior staff beyond the list of five individuals on her consent form. She became aware of this when she received copies of records after her access to information requests.

The parent contacted the school division about what she felt was a privacy breach. The school division indicated the purpose of the consent form was to address the sharing of information between the school division and external third parties. The school division also indicated it uses personal information internally based on the need-to-know principle in accordance with LA FOIP.

In addition, the school division indicated to the parent that the e-mail correspondence was deleted from devices and that staff will receive awareness training about information use. The parent thereafter contacted the SIPC and asked the commissioner’s office to investigate the matter.

The commissioner indicated in his findings that the sharing of the complainant’s e-mails among school division employees qualifies as a “use” and not a disclosure. He also indicated that section 27(a) of LA FOIP authorized the sharing of personal information in three of the incidents that he investigated, but the sharing of this information was not authorized in two other incidents.

Commissioner Kruzeniski recommended that these e-mails are deleted from any devices used by staff or any other person without a need to know. He also made several recommendations in the report about steps the Chinook School Division need to take to ensure its privacy policies and procedures address the need-to-know principle.

These recommendations include that the school division will issue an annual reminder to teachers and staff about the need-to-know principle. In addition, the school division need to ensure that employees document discussions and decisions completely and accurately.

“I also recommend that Chinook School Division ensure its employees are aware that section 5 of LA FOIP provides every person with a right to access records in the possession or control of the school division,” Kruzeniski stated in his recommendations. “Should any employee receive a formal access to information request, they should forward such a request to the school division’s access and privacy officer.”

The report suggests that the school division provides a written notice to parents, guardians and students about LA FOIP and the school division’s authority to collect, use, and/or disclose personal information. This should be done at the start of each school year or when a new student arrives at a school.

The Prairie Post requested comment from the Chinook School Division on the commissioner’s reports and recommendations. The school division provided a written statement in response to several questions.

“During review of all the recommendations, it was determined that Chinook has met some of the recommendations already and we are currently reviewing the remaining recommendations within the report,” the statement said.

The school division indicated the commissioner’s feedback will be useful when decisions are made about future access to information requests.

“This feedback is useful as we are always improving our practices with respect to the collection, use and disclosure of information under the Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP),” the statement said. “The school division’s obligation is to follow LA FOIP and assess whether it applies to the information request.”

The school division indicated in its response that their updated administrative procedures refer to uses of information within LA FOIP.

“The report confirmed that, as long as it is demonstrated that the individual that received the information was on a need-to-know basis, then consent was not required,” the school division said. “Upon reflection of the recommendation from the report, we have determined that our updated administrative procedures that are in place refer to uses of information within LA FOIP. Our administrative procedures appropriately address collection, use of information, disclosure and confidentiality.”

The school division indicated in response to a Prairie Post question that it will take steps to ensure parents, guardians and students are informed about LA FOIP.

“As a school division, it is important to us to inform parents and guardians about practices and procedures involving students,” the school division stated. “Therefore, we will implement this recommendation in the fall so that parents and students are aware of collection, use and disclosure of personal information under LA FOIP.”

The school division also indicated it will continually inform staff about their role and duties with regard to the requirements of LA FOIP.

“As stated within the recommendation, should any employee receive a formal access to information request, they should forward such a request to the school division’s access and privacy officer,” the school division noted. “We have trained our staff to recognize a request for information, either informally or formally, and forward to the Division’s access and privacy officer. During the time that this request was brought forward in 2020, the Chinook School Division was implementing a process to support, train and develop knowledge with our staff around LA FOIP and the division is committed to further training in the future.”