Enhancing Digital Security and Trust Act (EDSTA)

Enhancing Digital Security and Trust Act

Notice of Collection, Routine Use and Disclosure of Student Personal Information

Notice for parents, guardians and students

What this notice does

This notice explains why the Durham Catholic District School Board (DCDSB) collects student personal information, how it is normally used and shared, and who to contact with questions. It also explains the additional notice requirements that apply when student personal digital information is shared with third-party software applications used for school purposes.

Quick summary

  • DCDSB collects and uses student personal information to provide education, operate schools, support student safety and well-being, meet legal obligations and communicate with families.
  • Some collection, use and disclosure are required or authorized by law. In those cases, consent is not normally required, but questions or concerns may be raised with the school principal or the Board Privacy Office.
  • When a digital tool or software application will receive student personal digital information, EDSTA may require a separate plain-language notice. Notice is transparency. It is not automatically a request for permission or an opt-out process.
  • DCDSB uses administrative, technical and physical safeguards to protect personal information and limits access to staff, service providers and partners who need it for an authorized purpose.

Personal information (PI) has the same meaning as personal information in section 2(1) of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and means recorded information about an identifiable individual. This includes information such as a name, unique identifying number or symbol, or other information that identifies an individual either on its own or when combined with other information. Examples could include a name, student number, picture, address, gender, grades, or assessment information. It does not include information that has been de-identified or anonymized.


Digital tools include software, applications (apps), web services, browser extensions, and other digital technologies used for educational, administrative or operational purposes.


DCDSB uses digital tools to support instruction, assessment, communication, accessibility, student services and school, and Board operations. Approved third-party vendors such as Microsoft, PowerSchool, Edsby and D2L to name a few, may provide some of these tools. Depending on the purpose, a tool may involve limited student personal information.

The following table summarizes the main legal authorities for collection, use and disclosure. It is written in plain language and is not intended to replace the full legislation.

Law or requirement What it means
Education Act and Ontario Student Record requirements Schools must establish and maintain required student records, including the Ontario Student Record, and use those records to support instruction and other education-related purposes.
Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) MFIPPA governs the collection, use, disclosure, retention, access, correction and protection of personal information held by Ontario school boards. It also requires notice of collection unless an exception applies.
MFIPPA sections 31, 32 and 33 These sections address when personal information may be used, disclosed, and used or disclosed for a consistent purpose.
MFIPPA access and correction rights Students and parents or guardians, where permitted by law, may request access to or correction of personal information held by the Board.
Enhancing Digital Security and Trust Act, 2024 (EDSTA), O. Reg. 52/26 DCDSB must provide written notice that identifies the information, legal authority, purpose, application/vendor, Board contact and rights statement. Notice is normally provided to parents/guardians for students under 16 and to students who are 16 or 17.
Other applicable laws Specific situations may involve other laws, such as laws about immunization, public health, student safety, transportation, accessibility, child protection, court orders, law enforcement, or personal health information.

The examples below are common school and Board purposes. Not every item applies to every student.

Area Information that may be involved Why it is used or shared Legal authority/notes
Student records and enrolment Name, contact information, date of birth, parent/guardian information, student number, Ontario Education Number, school history, attendance and required records. Register students, maintain the Ontario Student Record, create timetables, maintain transcripts and report cards, transfer records when a student moves to another Ontario school, and meet Ministry of Education requirements. Education Act; Ontario Student Record requirements; MFIPPA.
Teaching, learning and student support Class, course, grade, attendance, student work, assessment results, learning profiles, Individual Education Plan information, accommodation needs, and staff observations about learning. Plan instruction, assess learning, support achievement and well-being, provide special education and accessibility supports, support transitions between grades, schools and programs, and improve school programs. Education Act; MFIPPA ss. 31-33; applicable special education and accessibility requirements.
School-to-home communication Parent/guardian contact information, student name, school, grade, class or program, attendance and school information relevant to the student. Communicate about attendance, safe arrival, emergencies, learning progress, school events, transportation, fees, forms and other school-related matters. Education Act; MFIPPA ss. 31-33.
Digital tools and online services Depending on the tool: name, school account, username, email, class/course, grade, student work, assessment information, usage logs, device or browser information, IP address, communications, photos/video/audio, or other information needed for the approved use. Support instruction, assessment, collaboration, accessibility, learning management, communication, administrative operations, payment processing, transportation, library services and other Board-approved school purposes. Education Act; MFIPPA; EDSTA O. Reg. 52/26 when student personal digital information is disclosed to a third-party software application.
Health, safety and emergency response Emergency contacts, medical plans of care, allergies, accessibility needs, safety plans, injury details, witness information, and other information needed to protect health or safety. Respond to emergencies, administer plans of care, support safe arrival, report incidents, support public health requirements, communicate with first responders, hospitals, insurers or authorized officials when needed. Education Act; MFIPPA; public health legislation; Personal Health Information Protection Act where applicable.
Transportation Name, address or stop information, school, grade, parent/guardian contacts, medical or accessibility information needed for safe transportation. Plan and provide transportation, communicate route or safety information, and support student safety while travelling to and from school. Education Act; MFIPPA; transportation service agreements and applicable safety obligations.
Ministry, public bodies and required reporting Student identifiers, enrolment, demographics where required, attendance, achievement, program, graduation and other required information. Meet reporting, funding, assessment, accountability, student record and legal obligations to the Ministry of Education, EQAO, public health authorities and other authorized public bodies. Education Act; MFIPPA; applicable regulations, Ministry requirements and public-sector reporting obligations.
Post-secondary applications and transitions Contact information, marks, credits, transcripts and other application-related records. Support student applications, scholarships, graduation, transition planning, college/university admissions and transfer to other education providers where authorized. Education Act; MFIPPA; student or parent/guardian request where required.
School events, activities, awards and yearbooks Student name, grade, class/team/group, participation, achievement, awards, photographs, video, audio, program details and student work. Recognize student achievement, run school activities and clubs, produce yearbooks and event programs, support athletics and competitions, and display student work in school or at school-related events. Education Act; MFIPPA; event participation requirements; consent or notice may be used where appropriate.
Media, photos, video and student work Photographs, video, audio, student work and limited identifying information. Use or display student work or images for classroom learning, assessment, school records, IDs, yearbooks, school communications or public events. External media or the general public may take photos at public events where permitted; the Board cannot control all external recordings. Education Act; MFIPPA; Board procedures and school communication practices.
Payments, photos and contracted services Student name, number, grade, school, fee/payment records, photograph information and contact information as needed. Support online payments, school photography, student cards, yearbooks, service delivery, reporting, support, printing, mailing, secure hosting and other authorized contracted services. Education Act; MFIPPA ss. 31-33; service-provider agreements and privacy/security controls.
Law, court orders and urgent safety matters Relevant personal information needed to comply with a legal requirement or address a serious health or safety situation. Comply with court orders, subpoenas, law enforcement requests where legally authorized, child protection requirements, public health requirements, or compelling health and safety circumstances. MFIPPA s. 32 and other applicable laws.

Digital tools can help students learn, create, collaborate, practise skills, receive feedback, access accommodations and communicate with educators and families. DCDSB reviews digital tools for educational value, privacy, security and appropriate use before approval where required.

EDSTA notice rule

If student personal digital information will be disclosed to a third-party software application, DCDSB must provide written notice. For students under 16, notice is normally provided to the parent/guardian. For students who are 16 or 17, notice is normally provided to the student.

Type of digital tool Purpose Student information that may be involved
Learning management and classroom platforms Deliver instruction, distribute materials, collect work and support online or blended learning. Student name, school account, grade, class/course, educator, student work, submissions and feedback.
Assessment and evaluation tools Administer assessments, gather responses, monitor progress and record results. Student name or identifier, grade, class/course, assessment responses, marks, rubrics and feedback.
Communication and collaboration tools Support communication between students, educators and families and allow collaboration on school work. Student name, school account, class/group membership, messages, comments, files or collaboration history.
Student information and administrative systems Support enrolment, attendance, scheduling, reporting, transportation, payments, student records and legal compliance. Student identifiers, demographic information required by law, school/grade/class, contacts, attendance, timetable, fees, transportation and administrative records.
Education, enrichment and experiential learning tools Support coding, creative work, simulations, research, presentations, virtual field trips, career planning and enrichment activities. Student name, class/group membership, school account, student-created content, project files and activity records.
Accommodation and student support platforms Support individual education plans, accommodations, specialized equipment, learning supports and student well-being services. Student identifiers, grade, course/class, Individual Education Plan information, accommodations, progress notes and related support information.
AI, analytics or automated features, where approved Support learning, accessibility, feedback, productivity, security or service administration only where approved for the intended use. Prompts, outputs, usage data, recommendations, automated feedback or other generated information, depending on the approved tool and configuration.

 

How DCDSB protects student information

  • Limits collection, use and disclosure to information needed for education, school operations, student safety or another authorized purpose.
  • Limits access to staff, service providers and partners who need the information for their assigned duties or authorized service.
  • Uses administrative, technical and physical safeguards appropriate to the sensitivity of the information.
    Reviews digital tools, software services and vendors for privacy and security risk before approval where required.
  • Requires service providers to use information only for Board-authorized purposes and to protect it from unauthorized access, use, disclosure, loss or destruction.
  • Maintains records according to legal requirements and Board records-retention practices.
  • Responds to suspected privacy or security incidents through Board privacy and cybersecurity procedures.

Questions, concerns and access requests

Situation Contact or response
Questions about school use of information Contact the school principal. The principal can explain the purpose, discuss concerns and consider reasonable alternatives where possible.
Questions about a specific classroom digital tool Contact the classroom educator, school principal or the DCDSB Privacy Office.
Privacy questions or formal access or correction requests Contact the DCDSB Privacy Office at privacy@dcdsb.ca or 905-576-6150 ext. 22386.
Concern about improper collection, use, retention or disclosure Raise the concern with the school principal or DCDSB Privacy Office. You may also contact the Information and Privacy Commissioner of Ontario.
Objections or alternatives Many uses are required or authorized by law and cannot be opted out of. For a discretionary use, staff may consider reasonable alternatives without preventing DCDSB from meeting legal, safety or educational obligations.

Legal references

Any questions about information contained in this Notice Statement may be referred to the board’s Privacy Office at privacy@dcdsb.ca or 905-576-6150 ext. 22386