Educational Technology and Privacy

Web-based technology and social media are increasingly used as learning tools in university courses. When requiring students to use these technologies, it is important to do so in ways that do not contravene privacy legislation (FIPPA). This law prohibits instructors from requiring that students’ personal information be stored or accessed on servers outside of Canada.

If you are considering using or already use an educational technology in your course, start with a ‘privacy check’.

Privacy Check: Am I Safely Adopting Educational Technology?

Want to know more?

Frequently Asked Questions:

Why do I need to know about privacy and educational technologies?

Educational technologies often collect and store personal information. As educators, we have both an ethical and legal responsibility to protect students’ personal information. We are careful about protecting student information from prying eyes and would never share a student’s personal information without their permission. Similarly, we need to be careful about the educational technologies we ask our students to share their personal information with. The information stored and accessed by educational technologies is not always safe: the technology may share this information with other people, groups, or organizations. When asking students to use educational technologies, there are a couple of things to think about that will help to protect student information. See the Flow Chart for details.

What is personal information?

Personal Information refers to recorded information about an identifiable individual. For example, names, email addresses, and addresses.

Does my educational technology have to be approved by UVic before I use it?

No. See our helpful Educational Technology Adoption Interactive Flow Chart to help you make decisions about using educational technology. There are resources to assist you if you have questions about a specific tool: You can check out our Tip Sheet, Technology List, or contact Technology Integrated Learning for help.

Can I ask students to use educational technologies in my class?

Yes. But first, an Educational Technology Adoption Interactive Flow Chart has been developed which sets out the steps to assist you in deciding how to adopt educational technology in your classroom. It is important for you to determine if the technology stores and/or accesses information outside of Canada.

Why does it matter if an educational technology stores information outside of Canada?

We need to be particularly careful about educational technologies which store and/or access information outside of Canada; these educational technologies are not always bound by Canadian law. In some cases, this can mean that foreign governments or persons may have access to students’ personal information. BC’s Freedom of Information and Protection of Privacy Act (FIPPA) limits this risk by prohibiting universities from requiring that students’ personal information be stored or accessed on servers outside of Canada. Privacy legislation means that you are required to protect student information, including knowing if such information is stored outside of Canada.

How do I know if technology stores data outside of Canada?

You can usually figure out where a technology stores or accesses data by consulting its Privacy Policy or Terms of Service. If you can’t figure it out, you can refer to our Technology List or contact Technology Integrated Learning for help.

How do we deal with consent?

The University Senate has approved a process for informed consent regarding the use of educational technologies in undergraduate courses which store information outside of Canada. You can check our information about this process in the Undergraduate Calendar. As an educator, you do not need to collect consent forms. You need to (1) inform students where the tool stores and accesses information and (2) provide alternatives. If students choose to use the educational technology after you have done this, they have consented to the storage and access of their personal information outside of Canada.

What do I need to do before asking students to use technology that stores information outside of Canada?

  • Inform students where the tool stores and accesses information, and that providing their personal information is not mandatory. It can be helpful to encourage students to read the tool’s privacy policy and/or terms of service.
  • Provide alternatives (for example suggest that students use an alias or provide an alternative way of completing the assignment).
  • You might also want to explain why you have chosen the technology and the benefits they may get by using it.

How do I inform students?

You can provide this information in the syllabus or course outline. If you would like, you can use this wording:

“I use a variety of educational technology in this course including internet-based technologies or web-based applications, cloud services and social media. The use of technology is part of your engagement at the University. Some of these learning tools may collect, use and/or disclose your personal information and store or access that information outside of Canada.

UVic cannot require students to disclose personal information to technologies or organizations which may store information on servers located outside of Canada because disclosure of personal information to vendors, systems or services storing or accessing that personal information outside of Canada is restricted by Section 30.1 of BC’s Freedom of Information and Protection of Privacy Act (FIPPA). Personal information is information about an identifiable individual; for example, your name or your email address.

The following educational technologies, which stores or accesses your personal information outside Canada, is required for this course: [LIST EDUCATIONAL TECHNOLOGY USED]. I will make you aware if this list changes.

I use these technologies to enhance your educational experience at UVic. The personal information is required by the service. The privacy policy and the terms of use list the personal information stored outside of Canada and are available at [INCLUDE LINKS]. I encourage you to read these documents.

If you are not comfortable with your personal information being stored outside of Canada, please speak to me within the first week of class about using an alternative (such as using an alias or nickname). Otherwise, by continuing in this course, you agree to the use of the educational technology in the course and the storage of personal information outside of Canada.”

What do you mean by “alternatives”?

If the educational technology you wish to use stores and/or accesses personal information outside of Canada, you must provide your students with options. You could offer one of the following alternatives to your students:

  • Suggest the student register for the tool using an alias (e.g., “Daffy Duck”). An alias (nickname which does not reveal identifiable information), non-identifying username and/or email address. Any alias information needs to be securely stored.
  • Allow the student to complete an alternative form of the activity.

What if there is no alternative?

If your course is required for the completion of your degree and has a required tool that collects personal information and there are no other technology options, then alternatives will be provided. Contact your department Chair for advice.

Is there a list of recommended educational technologies?

UVic maintains educational technology platforms and applications that are compliant with provincial legislation and university policies (e.g. FIPPA). UVic platforms/technologies that are supported by Technology Integrated Learning and are FIPPA compliant include:

Additionally, TIL maintains a list of educational technologies with information on where these tools store and/or access data. You can access this list here.

What if the contents of a student’s assignment contains personal information?

In this case, using an alias in the tool is not sufficient to protect student privacy. Another alternative needs to be provided. For example, the student could complete the assignment without using the tool or complete an alternative assignment.

What is FIPPA?

The UVic community is required to adhere to BC’s Freedom of Information and Protection of Privacy Act (FIPPA). This law applies to all public bodies in British Columbia. The University of Victoria is a public body. FIPPA details freedom of information (information rights and how to exercise them) and protection of privacy (collection, protection, and retention of personal information by public bodies; use and disclosure of personal information by public bodies). It is important to know that FIPPA states that storage and access of students’ personal information must be in Canada unless the student has consented. Essentially, this law prohibits UVic from requiring that students’ personal information be stored or accessed on servers outside of Canada.

Can I make the use of a technology mandatory/required in my class?

Yes, but how this works depends on where the tool stores and accesses personal information. You can require your students to use tools which store and access data only in Canada. For example, CourseSpaces is an educational technology which stores and accesses its data on the University of Victoria campus, located Canada. You can require your students to use CourseSpaces.

If a tool may store and/or access personal information outside of Canada, you cannot require your students to provide personal information to the tool. So, you can require students to use the tool, but you must provide a reasonable way for students to avoid having their personal information stored or accessed outside of Canada (e.g., by using an alias). For example, you can require students to use Twitter with an alias.

What happens if the educational technology tools that I want to use aren’t on the list?

If I just want students to use an app not a website, do the same rules apply?

Yes, it is the platform/software that matters, not just the device.

If activity is completely optional, and no grades allowed, do I still have to go over the checklist and inform the students?

Yes, more information is important here.

If students initiate use of educational technology that stores and/or accesses information outside of Canada, do the same rules apply?

No, if students are choosing to use the technology then it is not a privacy concern.

If I can’t use this for teaching, can I use this for administrative purposes? Can I store marks in Dropbox, for example?

No, student data should not be kept on servers that store information outside of Canada.

Who can I contact for assistance?

Can you give examples or information about the different ways instructors teach with technology?