Disclosure of students’ personal information to photography vendors

Gillian Tuck Kutarna, Greg Bush and Michael Cleveland of Miller Thomson LLP write about a decision in Canada on the kind of issue that might also come up here in the U.S. between school districts and vendors:

School boards may wish to review their procedures surrounding student picture days following a decision by the Office of the Information and Privacy Commissioner of Ontario (the “IPC”) involving the Toronto District School Board (the “Board”).

A privacy complaint arose after a photography vendor used the personal information provided by a school to advertise further services to a student’s parents. The IPC found that the Board’s collection and use of student photographs was in accordance with the Municipal Freedom of Information and Protection of Privacy Act (the “Act”); however, the IPC found that the Board’s notice of collection was not compliant with the notice provisions of the Act.

Read more on Lexology. It’s not like the school district hadn’t provided any information or disclosure, but what the IPC found was that what the board did was just not enough in terms of its arrangement with the photographer with respect to protection of the student information. As a result, the IPC made recommendations:

The agreements should provide that personal information is collected, retained, used, disclosed and disposed of in accordance with the Board’s obligations under the Act;
The agreements should explain that the vendor will take reasonable steps to protect the security and confidentiality of this information and ensure its destruction;
Personal information should not be retained by the photography vendor for longer than necessary; and
Parents/guardians should be clearly informed that they can request the vendor destroy the information so long as it does not interfere with the Board’s administrative requirements.

Leave a Reply Cancel reply