Student privacy: which law applies in your province?
The personal information that schools hold does not fall under the same law from one province to the next. For Quebec, here is what the laws say, section by section. For Ontario and the Maritimes, here is the law to consult and its official source. A summary of official sources, which does not replace the advice of your board's privacy officer.
Quebec
- Law 25, adopted in 2021, amended both Quebec laws on personal information: the one for public bodies (CQLR, c. A-2.1), which include school bodies (s. 3), and the one for the private sector (CQLR, c. P-39.1).
- School bodies include school service centres (Act A-2.1, s. 6). Before releasing personal information outside Quebec, a public body must conduct a privacy impact assessment (PIA) (Act A-2.1, s. 70.1). This is the law that applies to the school.
- The company that provides the app, such as Lino Ti Inc. for LinoClass, falls under the private sector law (Act P-39.1, s. 1). Before communicating personal information outside Quebec, it must also conduct a PIA (Act P-39.1, s. 17).
Ontario
The law to consult is the Enhancing Digital Security and Trust Act, 2024, with its regulations, on ontario.ca (see the sources). Our post on Regulation 52/26 sums up what it asks of school boards, with sources.
New Brunswick
The law to consult is the Right to Information and Protection of Privacy Act. The Government of New Brunswick explains who it applies to (see the sources).
Nova Scotia
The law to consult is the Personal Information International Disclosure Protection Act (see the sources).
Prince Edward Island
The law to consult is the Freedom of Information and Protection of Privacy Act (see the sources). To find out how it applies to your school, ask the privacy officer of your school board.
What about the companies that provide the apps?
In Quebec, it is Act P-39.1 (see above). At the federal level, the law to consult is PIPEDA (the Personal Information Protection and Electronic Documents Act); the Office of the Privacy Commissioner of Canada sums up its scope (see the sources).
Five questions to ask before adopting an app
- Where is student data hosted?
- Who are the subprocessors, and in which countries?
- How does a parent give or withdraw consent?
- How do you request deletion of the data, and how quickly is it done?
- Who is the person responsible for the protection of personal information?
LinoClass answers these five questions in its privacy policy: student work is hosted in Quebec, the full list of subprocessors is there, and a deletion request is carried out within 30 days.
Sources
- Act respecting Access to documents held by public bodies and the Protection of personal information (CQLR, c. A-2.1), LégisQuébec: s. 3, s. 6, s. 70.1
- Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), LégisQuébec: s. 1, s. 17
- Commission d'accès à l'information du Québec, main changes under Law 25: cai.gouv.qc.ca
- Government of Ontario, Enhancing Digital Security and Trust Act, 2024: ontario.ca
- Government of New Brunswick, who the Right to Information and Protection of Privacy Act applies to: gnb.ca
- Nova Scotia, Personal Information International Disclosure Protection Act: nslegislature.ca
- Prince Edward Island, Freedom of Information and Protection of Privacy Act: princeedwardisland.ca
- Office of the Privacy Commissioner of Canada, PIPEDA in brief: priv.gc.ca