BC Public Schools
[Learn360]
PIA# [assigned by your privacy office(r)]
Enquiry BC – Privacy and Access Helpline. Victoria: 250-356-1851 Vancouver: 604-660-2421 and elsewhere in BC, toll-free: 800-663-7867
Name of District: / <Name> Board of Education – SD <##>
PIA Drafter: / <Name, Title of School District Contact>
Email: / <Email of School District Contact> / Phone: / <Number of SD Contact>
Program Manager: / <Name, Title of initiative contact, if different from PIA Drafter>
Email: / < Alternate to the above / Phone: / <Alternate to the above>
Part 1 - General
NOTE TO DISTRICTS
<The RED text in this document should be removed from the final version of your District’s PIA.
We understand your District has chosen to make use ofthe BC Digital Classroom’s à la carte product by subscribing to Learn360. By conducting this Privacy Impact Assessment it will help your District ensure compliance with the Freedom of Information and Protection of Privacy Act when introducing new programs or initiatives that involve the collection, use and disclosure of personal information.
In an attempt to assist you in the deployment of this program or service, this partially completed Privacy Impact Assessment (PIA) template is ready for your edit and review. Please carefully ensure that this document accurately reflects your district’s intent and scope of your initiative.It is your responsibility to ensure that the information in this PIA is accurate and complete.>
Please do not remove any parts of the PIA. Where a section does not apply, enter “Not Applicable.”
1.Description of the Initiative
Educational Resource Acquisition Consortium (ERAC) is a cooperative member based organization. Our School District has an active membership with ERAC who provides a range of services available to its members including evaluating, licensing and acquiring print, software, and digital learning resources. ERAC works in partnership with their members, BC public school districts as well as independent schoolsto support quality education for public and independent K-12 students.
This Privacy Impact Assessment (PIA) is to facilitate our district’s use of Learn360, which is an “à la carte” addition to our subscription to the BC Digital Classroom Core Collection through ERAC. Learn 360 is an online multimedia collection designed for K-12 educators and students. The collection includes a range of digital learning resources, including: videos, video clips, audio and audiobooks, newsreel footage, audio and video speeches, music tracks, sound effects, and encyclopedia articles. It is aligned with the BC curriculum.
In preparation for the usage of this collection by studentsin our district, it is essential to ensure that it is accessed in a way that is compliant with the Freedom of Information and Protection of Privacy Act (FIPPA). Emailand Learn360 on-line servicesforSchool Districtfaculty andadministrativestaffareoutof the scopeof thisPIA.
Learn360 and its content may only be used for educational and student research purposes and not for any commercial or profit-making purposes.
Vendor: Infobase
Infobase is an America’s provider of Learn360 which is distributed in Canada by Visualed.com They provide supplemental educational materials to the school and library markets. The company was founded in 1940 and has a history of publishing award-winning and highly acclaimed resources for K–12 schools, academic institutions, and public libraries. The company is located at 132 West 31st Street, 16th Floor New York, NY 10001
Tel: 1-800-322-8755 or Fax: 1-800-678-3633.
Canadian Distributor: VisualEducational Centre (VEC)
VEC distributes the Learn360 audio and video educational resources in Canada and provides ERAC members with preferred pricing. They can be reached at 30 MacIntosh Blvd. Unit 7 Vaughan, ON L4K 4P1
Tel: 1-800-668-0749; Fax: 1-866-664-7545 or E-mail: .
This section should provide a general description of the initiative and the context in which it functions. This could include the purpose of the initiative, its benefits, the larger process (if any) that it is part of, how it functions, the parties involved, etc. For example, the public bodymay want to overhaul its student engagement processes to better align with emerging self-service trends, or a program is moving forward because it is a priority project of the head of the school district.
2.Scope of this PIA
Learn360 is an additional option of ERAC’s online collection of learning resources. Learn360 is a product of an educational resource company called Infobase Learning. The product meets the provincial standards and is deemed appropriate for use in BC classrooms, and has been granted approval in which an agreement has been made with Learn360 and ERAC membership.
The intended users are: K-12 students; classroom subject teachers; non-enrolling specialist teachers; students for non-instructional purposes; authorized Student Teachers on practicum; and, Educational Assistants. Our District has entered into a licensed subscription agreement with Learn360. This agreement, which is administered throughERAC,expires on July 1, 2018.
<DISTRICT NOTE:Please see sample consent form located in Part 7 in this document to be tailored to your District’s needs if student accounts are created using personal information. For further help with collection notices please seeTip Sheet for Consent &Disclosure located on the ERAC website.
3.Related Privacy Impact Assessments
It is our understanding that there is no current Learn360 PIA submitted to the Office of the Information & Privacy Commission of British Columbia (OPIC) or BC Ministry of Education.
4.Elements of Information or Data
There are three options for accessing Learn360:
Username / Password – A single username and password can be used to log in to Learn 360. This username and password can be shared with teachers and students within a school or district where the student remains anonymous.
Internet Protocol (IP) Authentication - IPbased authentication uses a school IP address or range of IP addresses to provide direct access to Learn360 and bypass the need for username and password. This can provide secure access to all authorized content and the full feature set of Learn360.
Referring Uniform Resource Locator (URL) – this uses a specific URL to direct teachers and students in a school which subscribes to Learn360 to available content within the collection.
Access to primary content and features on Learn360 is provided with generic, non-specific user information.
Content within the Learn360 collectioncan be used by authorized subscribers (including teachers and students) only for educational, non-commercial purposes.
Teachers may download content that is designated “downloadable” within the collection, and as long as it is used for non-commercial, educational purposes as outlined in the Learn360 terms available at:
Teachers may edit content that is designated as “editable” within the collection, and may use it for non-commercial, educational purposes as outlined in the Learn360 terms available at:
District authorized Learn360 Administrators can generate PassKey codes or links to allow teachers within schools to register their own accounts if this is desired. Educators need to know that any personal information added is stored in United States and if used, will require the completion of a consent form submitted to the district’s privacy office(r).
Please list the elements of information or data involved in the initiative. This could include student’s name, age, address, work/home email, work/home phone number, educational history, employment history, work status, health information, financial information, photos, comments on a blog, social media, or information specific to your subject area, like assessments, student results, or person(s) responsible for supervising the initiative.
Part 2 – Protection of Personal Information
In the following questions, delete the descriptive text and replace it with your own.
5.Storage or Access outside Canada
The Location of the servers that store personal data, and routing of personal information across networks,is in the United States.
In Canada, Visual Education Centre located in Ontario administers the program for Infobase.132 West 31st Street 16th Floor New York, NY, 10001
Please provide a brief description of whether your information can be or will be accessed from outside Canada, for example, a service provider that is repairing a system, or if your information is being stored outside Canada, for example, in the “cloud”. If your data is stored within Canada and accessible only within Canada, please indicate this. If it is stored outside of Canada, indicate the jurisdiction in which the “cloud” is located.
6.Data-linking Initiative*
In FIPPA, "data linking" and “data-linking initiative” are strictly defined. Answer the following questions to determine whether your initiative qualifies as a“data-linking initiative” under the Act. If you answer “yes” to all 3 questions, your initiative may be a data linking initiative and you must comply with specific requirements under the Act related to data-linking initiatives.- Personal information from one database is linked or combined with personal information from another database;
- The purpose for the linkage is different from those for which the personal information in each database was originally obtained or compiled;
- The data linking is occurring between either (1) two or more public bodies or (2) one or more public bodies and one or more agencies.
If you have answered “yes” to all three questions, please contact your privacy office(r) to discuss the requirements of a data-linking initiative.
As noted above, “Data linking" means the linking or combining of personal information in one database with personal information in one or more other databases if the purpose of the linking or combining is different from:
(a) the purpose for which the information in each database was originally obtained or compiled, and (b) every purpose that is consistent with each purpose referred to in paragraph (a). For example, in the case of the online product FreshGrade, the purpose of the linking is not different than the reason for which the information was originally obtained or compiled.
7.Common or Integrated Program or Activity*
In FIPPA, “common or integrated program or activity” is strictly defined. Answer the following questions to determine whether your initiative qualifies as “acommon or integrated program or activity” under the Act. If you answer “yes” to all 3 of these questions, you must comply with requirements under the Act for common or integrated programs and activities.- This initiative involves a program or activity that provides a service (or services);
- Those services are provided through:
(b) one public body working on behalf of one or more other public bodies or agencies; / No
- The common or integrated program/activity is confirmed by written documentation that meets the requirements set out in the FOIPP regulation.
Please check this box if this program involves acommon or integrated program or activity based on your answers to the three questions above.
With respect to being a “common or integrated program or activity”, that is a voluntary designation under FIPPA. A public body may choose to designate a program or activity as such when it needs to make use of s. 27(1)(e) or s. 33.2(d) of FIPPA as authority for indirect collection or disclosure of personal information.However, in the case of a school district’s disclosure of student information to FreshGrade, the disclosure is likely authorized by s. 33.2(c), (see Appendix C - Disclosure in this document) as being a service provider of the district. It is therefore not necessary for the district to designate the program as a common or integrated program or activity.>
* Please note: If your initiative involves a “data-linking initiative” or a “common or integrated program or activity”, advanced notification and consultation on this PIA must take place with the Office of the Information and Privacy Commissioner (OIPC). Contact your public body’s privacy office(r) to determine how to proceed with this notification and consultation.
For future reference, public bodies are required to notify the OIPC of a” data-linking initiative” or a “common or integrated program or activity” in the early stages of developing the initiative, program or activity. Contact your public body’s privacy office(r) to determine how to proceed with this notification.
8.Personal Information Flow Diagram and/or Personal Information Flow Table
Please provide a diagram and/or table that shows how your initiative will collect, use, and/or disclose personal information (see examples below). Your diagram and/or table must also include the authoritiesfor the collection, use, and disclosure of personal information(see Appendix B in this document), as laid out in FIPPA. It should also outline the flows of personal information wherever it is transmitted or exchanged.
<Both a flow diagram and a table must be included if the PIA is related to a common or integrated program or activity or a data-linking initiative.>
If the person completing this PIA is unsure of, the collection, use, and disclosure authorities of FIPPA found in Appendices A - C. or do not know what the relevant authorities are, please contactyour district/school privacy office(r).
Depending on the complexity of your initiative, you may choose to provide one general diagram for the initiative, and more specific diagrams for particular components. If multiple organizations will collect, use, or disclose personal information, the diagram should identify how each organization is involved in the initiative.
Example:
Note:The examples below can be removed and additional lines added as needed.
Personal Information Flow TableDescription/Purpose / Type / FIPPA Authority
1. / Email received from client requesting service / Collection / 26(c)
2. / Email client back requesting more information / Disclosure / 33.1(7)
3. / Service request transferred to service provider contracted by school district / Disclosure & Use / 33.2(c) and 32(a)
9.Risk Mitigation Table
Please identify any privacy risks associated with the initiative and the mitigationstrategies that will be implemented. Please provide details of all such strategies. Also, please identify the likelihood (low, medium, or high) of this risk happening and the degree of impact it would have on individuals if it occurred.
Note: The examples below can be removed and additional lines added as needed.
Risk Mitigation TableRisk / Mitigation Strategy / Likelihood / Impact
1. / Employees could access personal information and use or disclose it for personal purposes / Oath of Employment; contractual terms, etc. / Low / High
2. / Request may not actually be from client (i.e. their email address may be compromised) / Implementation of identification verification procedures / Low / High
3. / Client’s personal information is compromised when transferred to the service provider / Transmission is encrypted and over a secure line / Low / High
4. / Inherent risks in sending personal information to a client via email / Policy developed to inform clients of risk and ask if they would like the information via a different medium, such as through the mail / Medium / Medium
10.Collection Notice
Access to primary content and features in Learn360 is possible with generic, non-specific user information. However, to enhance and personalize user experience on Learn360, Infobase Learning may request teachers or students to provide certain personally identifiable information when registering for an optional account. This user data is collected on a voluntary basis.
This information could include: names, mailing addresses, and/or email addresses.
Personal information is used to:
- fulfill requests for support
- improve product offerings
- display and send customized content
- send updates such as newsletters, mail, email, surveys etc.
Student data is not used for commercial purposes and is only kept for education purposes.
Personal information is used internally by Infobase Learning technical and customer support staff to provide access to teachers and students.
Infobase does not share or sell personal information.
Sub-contractors working with Infobase do not have access to protected personal data about users.
Infobase Learningwill not to disclose any personally identifiable information to any other party:
a) without the prior written consent of the district; or
b) unless requested by statute or court order and the party provides notice to the clientthat the information was disclosed, unless such disclosure is expressly prohibited by statute or court order.
Infobase Learning complies with the Children's Online Privacy Act (COPPA). This means the company will not require a child to disclose more information than is reasonably necessary to participate in an activity, such as using Learn360.
Teacher who do register optional accounts are able to log in and update or change their contact or account information.
Teachers who receive email updates or communications can opt out of receiving these using the opt-out instructions included within each email.
When an agreement expires, districts can request that Infobase purge any teacher and student data collected through Learn360 from their systems.
Infobase may also automatically collect other information including: IP address, browser type, times that teachers or students are accessing the site and referring websites that they use to reach the site.
Infobase uses “cookies” which are small amounts of data stored on a teacher or student’s computer when they visit Learn360. Cookies to not contain personal information, but are used to personalize the content of the collection. Teachers or students can block cookies from being loaded on their computer by adjusting their browser settings
For specific requests about removing or updating personal information, the privacy coordinator for Infobasecan be reached at or by mail at Privacy Coordinator Infobase Learning 132 West 31st Street New York, NY 10001.
Note: If your initiative is collecting personal information directly from individuals you must ensure that all individuals involved are told the following:
- The purpose for which the information is being collected
- The legal authority for collecting it, and
- The title, business address and business telephone number of an officer or employee who can answer questions about the collection.
Please include your proposed wording for a collection notice and where it will be located for individuals to read before collection takes place. You can also attach a screen shot or a copy of your form where the collection notice would be located. For further help with collection notices please see the “Collection Notice Tip Sheet” located on the BC GovernmentCIO’s website.