What is FIPPA?

An important consideration in the selection of Learning Technologies is student privacy, including the storage, access, and sharing of personal student information between systems.

In British Columbia, FIPPA, the Freedom of Information and Protection of Privacy Act, ensures through legislation that public bodies develop a privacy management program. Student private information must be protected, meaning stored for valid reasons and not shared without consent. Bill 22 – 2021, passed on November 25, 2021, brings significant amendments to FIPPA, including the possibility of storing personal information outside of Canada. This expands the possibility to leverage a broader set of tools and technology, however, at UBC all tools must go through a Privacy Impact Assessment (PIA), a risk management and compliance review process used to identify and address potential information privacy and security issues.

UBC requires that all information about our students is gathered only through technologies that are part of our learning technology ecosystem, meaning technologies that have been officially approved after a Privacy Impact Assessment (PIA). If the use of another tool is required for a course, consent cannot be assumed by virtue of the student registering for the course.

What is personal information?

UBC defines personal information as “recorded information about an identifiable individual other than business contact information”. Even a student’s name and the fact that they are a UBC student is considered personal information. Learn more in the What is Personal Information Privacy Fact Sheet.

How does this affect my teaching?

All learning technologies supported by and implemented at UBC (e.g., Canvas, CLAS, Kaltura, etc.) have been officially approved after a Privacy Impact Assessment (PIA) and identified as FIPPA compliant. 

Many collaborative tools used in workplaces outside of UBC present potential information privacy and security issues, including Google Docs, Dropbox, Slack, Skype, and other tools.

Students should not be required to share their personal information with these services as part of any course (including setting up an account), however, if these tools support your pedagogical and instructional goals and help your students to build key skills and literacies, the following practices are recommended for their use.

1. Be transparent with your students on why you’re asking them to use these tools.
2. Provide a boiler-plate notice on what the tool is and how it stores their data (sample provided below):
   

   Data used for TOOL NAME may not be protected, as this tool has not gone through a Privacy Impact Assessment (PIA) and identified as FIPPA compliant. When you access the tool/site, you will be required to create an account. While TOOL NAME may have a privacy policy TOOL PRIVACY POLICY LINK, UBC cannot guarantee security of your private details on servers outside of Canada. Please exercise caution whenever providing personal information. You may wish to use a pseudonym to protect your privacy if you have concerns. Please feel free to contact UBC (access.and.privacy@ubc.ca) or TOOL NAME support team if you have any questions.

3. According to CTLT (UBC’s Centre for Teaching, Learning, and Technology), one recommended approach to complying with FIPPA and encouraging student use of such tools is to suggest their use of a pseudonym or alias, a false name that a student can use to set up an account.
   • Cloud-based tools may be used under the following conditions:
     1. Inform students that one of the resources they will be using is located on cloud-based servers (ideally, in the course syllabus) and during the registration process (so students can take this into consideration before they register).
     2. Advise students that they are asked to provide consent to the storage of their personal information (typically their name and email address, but the fields must be specified in the instructions) on the system.
     3. If they are concerned about having their personal information stored in the cloud, then they can use an alias.
     4. If an alias is used, they will need to inform the instructor of the alias.
     5. The instructor must keep a record of the student’s choice to use a generic ID or alias

*NOTE that students are fine to use these tools with their own private information, but this must be voluntary – the above boiler-plate phrasing reflects the opt-in nature of students sharing their information in this way.

Alternative Tools

Many tools in use outside of UBC may not be FIPPA compliant, but there are other tools that function in similar ways. Provided below are FIPPA-compliant alternatives for popular tools.

Interested in doing a PIA for a tool you would like to use for teaching?

Contact us at lddi.educ@ubc.ca and we’ll connect with UBC Privacy Matters to evaluate the possibility of conducting a PIA.

Useful Resources

UBC Access and Privacy Guide

Student Privacy and Consent Guidelines (Centre for Teaching and Learning with Technology – UBC)

Privacy Fact Sheet: Providing Personal Information Outside Canada

Questions, comments, or concerns? Send us an email!