FIPPA for Faculty 2: FIPPA and Student Information

students working on a project in class

Best Practices for Instructors

This advisory document communicates some best practices for faculty/student interactions in the course of conducting University business. It should be read in the context of the University’s Policy on Access to Information and Protection of Privacy, the Senate's Policy and Guidelines on the Conduct of Examinations and Policy on Academic Honesty and Access to Student Records and Protection of Privacy on the Registrar's website.

Personal Information Under FIPPA

Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA) defines personal information and sets out rules for the collection, use and disclosure of personal information as necessary to accomplish University academic, pedagogical and operational activities.

FIPPA’s rules for personal information are:

Collect only the personal information that you need to perform your duties
Inform people about the collection and about what you intend to do with their personal information
Only use personal information for the purpose(s) for which it was collected, or a consistent purpose
Don’t disclose personal information other than to the individual to whom it relates (except in limited circumstances as specified in FIPPA)

Collecting, Using and Disclosing Students’ Personal Information

Under FIPPA, personal information is recorded information about an identifiable individual, and includes such things as:

ethnic origin, race, religion, age, sex, sexual orientation, marital status
information regarding education (including an individual’s grades), financial, employment, medical, psychiatric, psychological or criminal history
identifying numbers, such as a Social Insurance Number or a student number
home address, telephone number, personal email address
personal opinions of, or about, an individual (including instructors’ evaluative comments on a student’s work)
correspondence sent to the institution by an individual that is of a private or confidential nature
the individual’s name where it appears with or reveals other personal information

Student Information Q&A

General

May an instructor ask students for their personal information?

A: Instructors may ask for personal information from students, but only as necessary for course or program delivery. The information collected must be used for the purpose for which it was obtained; for example, students may be asked to provide their name and mailing or email address for a class discussion or distribution list. Inform students of the purpose for which the information is being requested.

Are instructors entitled to have access to personal information in student records?

A: In general, access to information in student academic records is given on a need to know basis and as required by York faculty and staff, but the level and nature of access should be related to their particular duties. Normally, those employees involved in some aspect of academic administration or student affairs are given access to a student’s record. For example:

Faculty members and administrative staff who are charged with academic advising functions or those who serve on petitions or appeal committees are entitled to confidential access to student records for those particular purposes;
Faculty administrators, such as department chairs, and administrative staff may access student records for administrative purposes.

A course instructor may need to know particular information about a student, such as whether someone is registered in their class, but instructors would normally request that information from an authorized member of the staff with responsibility for class enrolment and registration lists rather than obtaining it directly from a student’s academic record.

Can an instructor share students’ personal information with other employees in the University?

A: Yes – but only with other employees whose duties and responsibilities authorize them to have access to that information and who need the information in order to carry out their duties. If instructors or staff wish to share a student’s information beyond those with authorized access, they must obtain the student’s consent for so doing.

If instructors or staff have doubts about whether someone is authorized to access or disclose student information, they should contact the Registrar’s Office or their Faculty OSP Director, or the Information and Privacy Coordinator.

Examinations, Assignments and Evaluations

Are examinations, assignments and grades considered personal information under FIPPA?

A: Yes. In a university context, personal information includes students’ papers, assignments, tests and examinations, grades and academic standing, and instructors’ evaluative comments on their work.

How should students’ attendance be taken at final exams?

A: Students should sign an attendance roster showing only their name and the last four digits of their student number. Don’t have students sign a list where they can see other students’ full name and complete student number.

How long should final exams be retained?

A: Graded final examinations that are not returned to the student must be retained for at least one year after last use so that the student has a reasonable opportunity to obtain access to them. Beyond the one year retention requirement, final examinations may be retained by Faculties only so long as there is operational need for them, and then confidentially destroyed.

How should final exams be stored and accessed?

A: Faculties are responsible for overseeing development and implementation of procedures for the secure handling of used exam booklets by teaching units. As a best practice, store used examination booklets in secure areas (a locked cabinet and/or a room where access is controlled).

What practices should be followed in collecting and returning student work?

A: To protect individuals’ privacy, students’ work should be collected with adequate supervision and security and should be retained and returned to them with due attention to security. Where possible, return work directly to the student. Do not leave documents for pick-up in a general area where students may see others’ assignments.

Any unclaimed student work should be retained for one year in order to provide ample opportunity for students to retrieve it, and then confidentially destroyed.

What procedures should be followed in making comments on student work?

A: It is preferable to write comments and grades inside the cover, not on the front page where others may see them.

Can students mark each others’ tests in class?

A: Yes. This is a pedagogical exercise and part of group learning activities. It is recommended that notice be provided to students in the course syllabus that some tests may be marked by students in class.

Can student grades be posted?

A: Yes, when anonymity can be assured. Grades are the student’s personal information, and the posting of grades in any format that can lead to the identification of an individual (grade + name +/or student number) would be considered an invasion of their personal privacy. It is acceptable to post students’ grades in a list containing only the grade and the last four digits of the student number, but it is preferable to use secure electronic means (such as modules available within learning management software, e.g. WebCT) so students see only their own grades.

Can students find out how their grades compare to other students’ grades in the class?

A: Yes - class averages appear on undergraduate students’ transcripts, although for final grades only. In other situations, if instructors wish to provide some indication of how a student’s grade compares to others in the class, this should be done without revealing personal information – providing a list of grades only, without names, student numbers or other personal identifiers. Note that this practice is not recommended in very small classes where it might not be possible to ensure anonymity when posting grades comparisons.

What practices can help to protect the personal privacy of students with disabilities who may require accommodation in writing tests, exams or term work?

A: Make every effort to distribute all examination, testing and term work results, including those from students who have tested through the alternate examination centre, to students at the same time.

Communicating with Students

What practices should be followed in communicating with students by email?

A: Email is a useful method for communicating with students about course-related information. However, if email messages relate to the operation or administration of the University, they may be subject to access to information requests (and may be disclosed) under FIPPA. The following best practices should be observed:

Maintain a professional tone in email communications – they may be forwarded to or retained by others, or inadvertently transmitted to unauthorized recipients, and they could be requested under FIPPA;
Retain email sent to and received from students containing personal information for at least one year if that information was used (in advising them, in course-related communication, and so on);
Always be cautious about including others’ personal information in email messages. Be aware that email messages sent to non-York email accounts are not secure for transmitting personal, sensitive or confidential information.
Unless encrypted, email is not recommended for transmitting highly sensitive or confidential personal information (such as educational history, financial information, evaluations, etc.). However, secure methods for transmitting sensitive information are available – contact your Faculty's or UIT’s Helpdesk for information.

Can student email addresses be displayed in a group mailing?

A: No. Instead of displaying individual student names and email addresses in a group mailing, include individual names or a distribution list in the email message’s bcc line, or create a listserv or other specific purpose mailing list.

Can students’ attendance be taken in classes?

A: Yes, but collect only the information needed to confirm a student’s presence. A good practice would be to have students sign an attendance sheet with their name and the last four digits of their student number. Don’t have students sign a list where they can see other students’ full name and complete student number.

How should students sign up for group work?

A: Collect only the minimum of information required to facilitate group work. Ideally, students would have access to a secure electronic portal function for group signup. Where group work is an established part of the course, inform students in the course syllabus that their personal information will be collected and used to develop group work schedules.

This document has been developed to assist in establishing good practices and procedures. Additional questions or requests for advice on records and information management or information and privacy issues should be referred to the Information and Privacy Coordinator: info.privacy@yorku.ca.