Recently, the Office of the Privacy Commissioner of Canada (“OPC”) issued its 2017 Global Privacy Enforcement Network Sweep results (the “Report”), which focused on certain privacy practices of online educational tools and services targeted at classrooms. The OPC examined the privacy practices of two dozen educational websites and apps used by K-12 students. The “sweep” sought to replicate the consumer experience by interacting with the websites and apps, and recording the privacy practices and controls in place. The overarching theme of the Report is “user controls over personal information,” which the OPC further refined into four subthemes: (1) transparency, (2) consent, (3) age-appropriate collection and disclosure, and (4) deletion of personal information.
- Transparency. The OPC found that, although all of the websites and applications had privacy statements, only 78 percent were readily accessible at registration. The OPC underscored the importance of having clear and thorough descriptions of the organization’s privacy practices. The Report recommends as a best practice the “layered” approach, whereby organizations list short privacy statements that link to more detailed descriptions of how the organization processes personal information. The Report also recommends that organizations provide parents with printouts explaining their privacy practices.
- Consent. The Report highlights the importance of obtaining meaningful, age-appropriate consent from students or parents for the processing of students’ personal information, in accordance with the Personal Information and Electronic Documents Act (“PIPEDA”). Pursuant to PIPEDA, consent is valid only if it is reasonable to expect that the individual whose personal information is collected would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting. Accordingly, to obtain meaningful consent of children under the age of 13, PIPEDA requires the consent of a parent or guardian. For children aged 13 to the provincial age of majority, PIPEDA requires that the consent process be adapted to the child’s level of maturity. The Report found that many of the apps and websites reviewed did not have different consent mechanisms for younger and older students. The OPC highlighted as a best practice a mechanism that would send an email to parents with instructions for how to sign their under-13 child up for the service, and kid-friendly explanations of consent mechanisms for children over the age of 13. Additionally, the OPC found that more than a third of the apps and websites reviewed obtained only the consent of the teachers, and not the students or parents, in violation of PIPEDA.
- Deletion. The final area the Report focused on was the ability for users to request to have their personal information collected by the website or app deleted. Pursuant to PIPEDA, organizations must delete or anonymize personal information that is no longer required for the purpose for which it was collected. Over a third of the apps and websites reviewed by OPC did not have procedures in place to allow students or parents to delete students’ personal information. The Report recommends that websites and apps provide students and parents with a straightforward procedure to delete students’ personal information and implement and enforce data retention schedules.