PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-020008-1

 

 

Greater Essex County District School Board

 

 

 

 

April 3, 2003

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-020008-1

 

 

 

MEDIATOR:                                                            Andrea Schwartz

 

 

 

INSTITUTION:                                            Greater Essex County District School Board

 

 

 

SUMMARY OF COMPLAINT:               

 

The complainant wrote to the office of the Information and Privacy Commissioner/Ontario regarding her contention that the Greater Essex County School Board (the Board) disclosed her personal information in contravention of the Municipal Freedom of Information and Protection of Privacy Act (the Act). 

 

Specifically, the letter of complaint set out that an art teacher at a named public high school discussed the probable grade which the complainant was to receive on her art assignment with two other students.  The complainant advises that the art teacher stated that the artwork belonged to “a girl in OAC”.  In addition, she advises that her name was on the front of the artwork. 

 

Included with her letter of complaint was a statement from one of the students to whom the complainant indicates this information was disclosed.

 

BACKGROUND:

 

During the course of the investigation into this matter, the complainant advised that she became aware of the disclosure of her personal information as a result of a conversation she had with a fellow student from her art class.  Specifically, the complainant indicates that her fellow student approached her and told her that their art teacher had disclosed the complainant’s grade to her.  The complainant indicates that that student also told her that their art teacher proceeded to explain the reasons why the complainant was given that particular grade.

 

The Board was contacted and advised of the substance of the complaint.  After conferring with the art teacher, the Board advised that the art teacher had confirmed that the artwork was on display.  However, the art teacher denied discussing the complainant’s grade with any other students. 

 

As set out above, the complainant provided a statement from the aforementioned student with her complaint letter to this office.   Several attempts were made to contact that student to confirm the information set out in her statement.  These efforts however, were unsuccessful.

 

During the investigation, I learned that there may be occasions where student art is displayed at the school, with students’ names indicated on the front, and with the grade assigned to the art written on the back.

 

The complainant’s position is that, while she does not have a problem with her artwork being displayed, she is concerned that the art teacher discussed the grade he had given her with another student.

 

DISCUSSION:

 

Is the probable grade “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines “personal information” as “recorded information about an identifiable individual, including,

 

            …

 

(b) information relating to the education or the medical psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

 [emphasis added]

 

The complainant’s concerns relate to a claim of a verbal disclosure of her probable grade on an art assignment.  Subsequent to filing her complaint, the complainant provided this office with a package of documents, including a letter dated April 18, 2002.  In that letter, the complaint sets out that a classmate was told that her work deserved a specified grade.  In fact, the complainant received a different grade.   Based on that letter, it appears that the grade reportedly disclosed to this classmate was not the same as the grade which the complainant ultimately received.  In these circumstances, it must be determined whether the disclosure of such information would qualify as “recorded information” as set out in the definition of “personal information” contained in section 2(1) of the Act.

 

This Office has taken the position that verbal disclosure of personal information falls under the privacy provisions of Part 2 of the Act, as long as the information in question exists or existed at one time in recorded format.  To decide otherwise would facilitate the circumvention of the non-disclosure rules contained in Part 2, and would be inconsistent with the purposes of the Act [See Investigation Report MC-980055-1]. 

 

On that basis, verbal disclosure of a grade which existed in recorded format would meet the requirement that the information be “recorded” as set out in the definition of “personal information” contained in section 2(1) of the Act.  In this case however, as the grade recorded by the teacher does not appear to be the same as the grade reportedly disclosed to her classmate, any such verbal disclosure would not relate to information which existed in recorded format.  Therefore, even if the verbal disclosure took place as the complainant contends, what was disclosed would not qualify as “personal information” as defined by section 2(1) of the Act. 

 

Since Part II of the Act deals with personal information, it is not necessary for me to determine whether this disclosure actually occurred, or whether it complied with the disclosure rules in Part II.  Nevertheless, any potential verbal disclosure of information about student grades raises privacy concerns, which I will review below.

 

OTHER ISSUES ARISING FROM THIS INVESTIGATION:

 

The information provided to me by the Board in this case indicates that student art may be displayed in the school with the name of the student on the front and the assigned grade written on the back.  This raises a concern as to whether the practise of recording and displaying artwork could result in the disclosure of personal information as defined by the Act. 

 

The preamble to the definition of “personal information” defines it as “recorded information about an identifiable individual, including …”, followed by a list of examples of things that would qualify as personal information.  In Order 11, former Commissioner Sidney B. Linden indicated that “[i]t is clear from the wording of the statute that the list of examples of personal information under subsection 2(1) is not exhaustive.”  The essential issue is whether the recorded information is about an identifiable individual.

 

In my view, there is no question that a grade given to a student’s art assignment qualifies as recorded information about an identifiable individual and is therefore the student’s personal information.  I am reinforced in this conclusion by paragraph (b) of the definition of “personal information” in section 2 of the Act, since there is no doubt that the complainant’s grade on her artwork is “information relating to the education…of the individual”.

 

Accordingly, based on the preamble and paragraph (b) of the definition of “personal information” in section 2 of the Act, I have concluded that a student’s grade on their artwork would qualify as personal information under the Act.

 

The obligations of an institution with respect to the disclosure of personal information are governed by section 32 of the Act.  Under the Act, an institution cannot disclose personal information in its custody or under its control except in accordance with the specific circumstances outlined in sections 32(a) through to 32(l) of the Act.

 

As noted previously, the Board indicates that there may be occasions where student artwork is displayed with the student’s name on the front of the work and the assigned grade written on the back.  Since it is not claimed that anyone has actually turned over a piece of student art and looked at the grade assigned, there is nothing to indicate that this practice has resulted in the actual disclosure of personal information.  However, this practice raises the issue of whether reasonable measures are in place to prevent unauthorized access to students’ grades.

 

Section 3(1) of Regulation 823, as amended, states that:

 

Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking in account the nature of the records to be protected.

 

I am of the view that while the grades themselves are not displayed as such, it is possible for individuals to view the back of a displayed assignment and thereby obtain unauthorized access to the grade assigned to a student. 

 

In addition, regardless of whether the information was “recorded” and therefore technically qualifies as “personal information” under the Act, any potential discussions or disclosure by Board staff of information relating to students’ grades raises privacy concerns, and is strongly discouraged.

 

During the investigation, I enquired about the Board’s practices and policies regarding verbal disclosure of student grades by staff.  As I was not provided with any information to indicate that the Board has a policy in this regard, I have concluded that the issue of verbal disclosure raises an additional privacy issue. 

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigations:

1.            In the circumstances of this complaint, the information at issue is not “personal information” as defined by section 2(1) of the Act.

 

2.            An actual recorded grade of a student would qualify as “personal information as defined by section 2(1) of the Act.

 

3.            Information provided to me in the course of the investigation raises concerns about possible unauthorized access to personal information as addressed in section 3(1) of Regulation 823.

 

RECOMMENDATION:

 

I recommend that the Board ensure that a policy is in place to prevent the unauthorized disclosure of student grades.  This policy should specifically address the issues of verbal disclosure of any information relating to students’ grades, as well as the issue of displaying of students’ assignments.

 

By June 26, 2003, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

Original signed by:                                                                  April 3, 2003

Andrea Schwartz Mediator