Personal Information and Privacy

School boards collect, use and disseminate personal information from, and about, individuals in the course of providing educational services and to administer programs in with the Education Act and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

Personal information refers to recorded information about an identifiable individual.

Personal information may be used or disclosed by the Upper Grand District School Board

• for the purpose for which it was obtained or a consistent purpose (a purpose consistent for the reason collected);
• to board officers or employees who need access to the information in the performance of their duties if necessary and proper in the discharge of the board’s authorized functions;
• to comply with legislation, a court order or subpoena or to aid in a law enforcement investigation conducted by a law enforcement agency;
• in compelling circumstances affecting health or safety and
• under the authority of the Education Act and Regulations (R.S.O. 1990 c.E.2) as amended.

It is our practice to include a notice of collection statement on forms used to collect personal information to advise you how we will use and disclose the information, and who to contact if you have concerns.

The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), passed in 1989, gives everyone a legal right to access public records and to expect protection of their personal records in the care of public institutions. 

MFIPPA

• governs the relationships between public bodies (e.g. school boards) and private persons regarding information;
• provides access to information subject to specific and limited exceptions;
• provides for the protection of privacy respecting personal information subject to exceptions;
• provides for a review of decisions on appeals to the Information Privacy Commission (IPC).

In accordance with the Act, requests for general information must be made in writing and include sufficient detail to enable staff to identify the record.  All requests are kept confidential and every effort is made to complete them within 30 days of the date of receipt.

Upon receipt of the request you will be notified if: 

• further information to the documentation is required;
• the 30-day time limit must be extended and why;
• a record must be severed and why;
• access is denied and why;
• the estimated fee exceeds $25.00.

Fees:  If you are making a request to access general information, the following fees apply:

• $5.00 administration fee to accompany a request;
• Search time – $7.50 per 1/4 hour;
• Record preparation – $7.50 per 1/4 hour;
• Photocopying – $.20 per page;
• Computer Programming – $15.00 per 1/4 hour;
• Any costs involved in locating, retrieving, processing and copying a record specified in an invoice received by the board.

An estimate will be given for any requests estimated to be over $25.00. If it is $100.00 or more, a deposit of 50% is required before the request is processed. All fees are payable before the requested records are provided.

Policy 315 - Privacy Protection and Information Access Policy and Procedures identifies the Director of Education as the Freedom of Information (FOI) Head.

For more information, please email [email protected]

GDPR

The European Union’s (EU) General Data Protection Regulation is a privacy law intended primarily to protect personal data rights. It is designed to give individuals in the EU control over how their data is processed and used. Although it is an EU law, the GDPR may apply to Upper Grand District School Board (UGDSB, or “the board”) and other public institutions in certain limited circumstances.

GDPR Notice

What is the purpose of this Notice? 

The UGDSB is committed to respecting and protecting the privacy rights of persons in the EU pursuant to the General Data Protection Regulation (“GDPR”). This GDPR Notice describes what kinds of personal information we keep and process about EU residents, for what purpose and other key information about our privacy practices. Please note, these practices apply to personal information of individuals residing in the EU. For information about the board’s privacy practices for Canadian students, please review board’s 315 Privacy Protection and Information Access Policy  or visit our privacy webpage.

Who should you contact if you have questions about your privacy? 

The Upper Grand District School Board may be considered a controller of your personal data. The board’s contact address is: 

Upper Grand District School Board
500 Victoria Road North, Guelph, ON N1E 6K2

Data Protection Officer, PrivacyREMOVE@ugdsb.on.ca.  

What information does the UGDSB collect and process about you?   

The UGDSB collects and retains personal information about students in order to provide educational programs. More specifically, the board processes the following types of information: 

• Contact information:information you have provided to us about your child will enable us to contact you, such as name, home address, email address, emergency contacts. 
• Registration/Application information:information you provided on your registration/application form and any supporting documents requested as part of your admission to the International Student Program (ISP), or if you are eligible to attend as a foreign student. 
• Academic records:records maintained about your studies at the school board, including assessments, grades, academic status. 
• Financial information:information about your tuition, scholarships, and other fees (ISP, foreign students).  
• Information about other services: information about your use of other academic and non-academic services and supports.

How does the UGDSB store and handle your information? 

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, including some databases that are shared between the board staff who need this information to do their job. Access to your personal information is limited to applicable board staff, necessary to provide educational and/or clerical services.

In addition to this, the board may process some information about you that is deemed ‘sensitive’ or personal data, and which requires additional protections. This information is always collected directly from you, never collected without your knowledge and is only collected if necessary, to provide supports and services.  

For what purposes does UGDSB use your information? 

The UGDSB will process your personal information for a range of purposes, including: 

• To deliver and administer your education, record the details of your studies (including any placements with external organizations), and determine/confirm your academic achievements (e.g. grades, awards).
• To administer the financial aspects of your relationship with us.
• To provide access to facilities and services to you (e.g. IT, athletics, libraries, accommodations, career placement).
• To enable your participation at events (e.g. graduation)
• To communicate effectively with you by mail, email and phone, including the distribution of relevant newsletters and notices.
• To operate security, governance, disciplinary, complaint, audit and quality assurance processes and arrangements.
• To support your training, medical, health, safety, well-being requirements, and creed and gender identity and expression accommodations.
• To compile statistics and conduct research for internal and statutory reporting purposes.
• To fulfill our responsibilities under legislation.
• To enable us to contact you or others in the event of an emergency.

What is the lawful basis for processing this information? 

The UGDSB processes this information to fulfill the board’s legitimate interests, functions and responsibilities as a public, educational institution. The processing of your personal information is necessary for: 

• the performance of our contractual obligations with you (e.g. to manage your student experience and welfare while studying at the UGDSB);
• compliance with a legal obligation (e.g. statistical reporting to the Ministry of Education and ONSIS);
• the performance of tasks we carry out in the public interest or for the board’s official functions (e.g. teaching and research);
• the pursuit of the legitimate interests of the UGDSB(g. assess your application for admission),

If we require your consent for any specific use of your personal information, we will collect it at the appropriate time and you can withdraw this at any time. 

When we process your sensitive personal information on the basis of your consent, you may withdraw that consent at any time by contacting the Data Processing Officer. If you withdraw your consent, we may still be required to process your sensitive personal information to comply with applicable law, but we will explain to you at the time your consent is withdrawn, what processing activities will continue for legal compliance purposes.

Who do we share your information with?  

We share your information only as necessary for the purposes outlined above. Who your information is shared with depends on whether you are a prospective, current, or former student (or such a student’s parent or guardian), staff member, or have some other status, and the types of personal data that you provide.  The categories of recipients are likely to include one or more of the following:  

• Other employees: we share your personal information within the UGDSB with those employees who need the information in the performance of their duties.(for example, administrative staff in the school office will have access to personal data related to student admissions, class registration, enrollment, grades and transcript); 
• Government departments and agencies: ifrequired by departments and agencies, employees of the provincial or federal government, may receive your personal data; such persons will generally be located in Toronto or Ottawa, Ontario.
• Third party service providerswhere processing is necessary for the purposes of legitimate interests pursued by the UGDSB (e.g. OSBIE, the board’s insurance plan providers, health insurance providers, yearbook and photography providers, software providers)  

The UGDSB does not share your information for marketing or commercial purposes outside of what is permitted under the GDPR.  

Transfer of Personal Data Outside of Canada or International Organizations 

The majority of your personal information processing happens in Canada, however, if the UGDSB has a contract with a third–party service provider that is based in another country, or you are participating in a student exchange program, the UGDSB may be required to transfer your personal data.  

In transferring your personal data, UGDSB will employ suitable safeguards to protect the privacy and security of your personal information so that it is only used in a manner consistent with your relationship with the UGDSB and this notice. 

How long do we keep your information for? 

The UGDSB keeps your personal information as required by law, and no longer than necessary to perform our legitimate interests. The board has an established records retention schedule in accordance with the board’s 316 Records and Information Management Policy. If you have specific questions concerning how long a certain type of personal data will be retained, please contact PrivacyREMOVE@ugdsb.on.ca. 

What rights do you have with respect with your personal information?   

As a Data Subject pursuant to the GDPR, you have certain rights.  This GDPR privacy notice summarizes what these rights under the GDPR involve and how you can exercise these rights.  More detail about each right, including exceptions and limitations, can be found in Articles 15-21 and 77 of the GDPR. 

The Right of Access 

You have the right to request that the UGDSB confirm whether it is processing your personal information.  If the UGDSB is processing your personal information, you have the right to access that personal information, and the UGDSB will provide you with a copy of that personal information unless prevented by applicable law.  

The Right of Correction  

You have the right to request that the UGDSB correct any inaccurate personal information that it maintains about you.  You also have the right to request that the UGDSB complete any incomplete personal information that it maintains about you, which could be accomplished by incorporating a supplementary statement that you submit.  If the UGDSB concurs that the personal information is incorrect or incomplete, the UGDSB will promptly correct or complete it.    

The Right to Erasure 

You have the right to request the erasure of personal information that the UGDSB maintains about you in certain circumstances.  These circumstances are identified in Article 17 of the GDPR and include that the personal information is no longer necessary in relation to the purpose(s) for which it was collected or otherwise processed.

Please note, there are exemptions where the UGDSB can refuse to erase your data, for example, where the UGDSB still needs your information for compliance with a legal obligation or where the information is necessary for the establishment, exercise or defense of a legal claim, in which case the UGDSB will retain the information until no longer needed.  

The Right to Restrict Processing of Personal Information 

You have the right to request that the UGDSB restrict the processing of your personal information where one of the reasons identified in Article 18 of the GDPR apply.  These reasons include that the personal information is inaccurate, the processing is unlawful, or the UGDSB no longer needs the personal information.  

If the UGDSB grants your request to restrict processing, the UGDSB will only process that personal information with your consent, for the protection of the rights of another natural or legal person, for reasons of important public interest, for the establishment, exercise or defense of legal claims, or as otherwise required by applicable law.  

The Right to Data Portability 

Where the basis for processing is either consent or performance of a contract between you and the UGDSB, and where the processing is carried out by automated means, you have the right to receive your personal information that you have provided to the UGDSB. The UGDSB will provide the personal information in a structured, commonly used, and machine-readable format.  Where technically feasible and upon your request, the UGDSB will transmit the personal information directly to another entity.   

The Right to Withdraw Consent 

If the basis for processing your personal information is consent, you may revoke your consent at any time.  Upon receipt of your notice withdrawing consent, and if there are no other legal grounds for the processing, the UGDSB will stop processing the personal information unless the processing is necessary for the establishment, exercise, or defense of legal claims.  Revoking consent does not affect the lawfulness of processing that occurred before the revocation.  

The Right to Object to Processing 

In certain situations, you may have the right to object to processing of your personal information  

• Public Interest or Legitimate Interests. If the basis for processing your personal information is public interest or legitimate interests, you have the right to object to processing the personal information. The UGDSB will cease processing unless it demonstrates overriding legitimate grounds for processing or the processing is necessary for the establishment, exercise, or defense of legal claims.
• Direct Marketing. If the UGDSB is using your personal information for direct marketing purposes such as fundraising, you have the right to object at any time, and the UGDSB will stop using your personal information for that purpose.

The Right to File a Complaint 

You have the right to submit a complaint with an EU supervisory authority, in particular the one in the EU Member State of your habitual residence, place of work, or place of the alleged violation, if you believe that the UGDSB’s processing of your personal information violates the GDPR.   

For more information on the process for submitting a complaint, consult the relevant EU supervisory authority: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/ index_en.htm. 

The Right to Know if UGDSB Uses Your Personal Data in Automated Decision-Making, Including Profiling 

The GDPR limits UGDSB’s right to use your personal data for predictive purposes as part of an automated decision-making process, including profiling.  Such a process uses your personal data, such as preferences, interests, behaviour, locations, and personal movement, to make an analytically-determined decision, instead of a personalized, individual decision.   The GDPR limitation does not apply when such automated decision-making is necessary for the performance of a contract to which you are, or will be, a party.  The UGDSB does not intend to use personal data in an automated decision-making process, except in the context of such a contract. However, if it does, it will seek your consent for such use.

Resource

GDPR Official website