School boards may wish to review their procedures surrounding student picture days following a decision by the Office of the Information and Privacy Commissioner of Ontario (the “IPC”) involving the Toronto District School Board (the “Board”).

A privacy complaint arose after a photography vendor used the personal information provided by a school to advertise further services to a student’s parents. The IPC found that the Board’s collection and use of student photographs was in accordance with the Municipal Freedom of Information and Protection of Privacy Act (the “Act”); however, the IPC found that the Board’s notice of collection was not compliant with the notice provisions of the Act. School boards have a duty to provide notice to parents, guardians, and students which explains the Board’s authority to collect photographs, the principal purposes for which they will be used, and who may be contacted for questions. The fact that the school calendar made reference to “picture day,” and the fact that parents received a pamphlet from the photographer outlining their services, was not sufficient to put the Board in compliance with the Act.

The IPC found that the Board was permitted to disclose personal information to the photography vendor, and that it was reasonable to expect this information would be used for specific, limited marketing purposes. However, the IPC also found that the Board’s service agreement with the vendor did not contain adequate provisions for the protection of students’ personal information. The IPC made the following recommendations:

  • The agreements should provide that personal information is collected, retained, used, disclosed and disposed of in accordance with the Board’s obligations under the Act;
  • The agreements should explain that the vendor will take reasonable steps to protect the security and confidentiality of this information and ensure its destruction;
  • Personal information should not be retained by the photography vendor for longer than necessary; and
  • Parents/guardians should be clearly informed that they can request the vendor destroy the information so long as it does not interfere with the Board’s administrative requirements.

It should also be noted that a school board’s collection, use and disclosure authority is circumscribed by its duties and responsibilities.