Please be advised that the Saskatchewan Office of the Information & Privacy Commissioner (IPC) has released an Investigation Report regarding a privacy breach that occurred in June 2019 in school divisions across the province when the Saskatchewan Teachers' Federation (STF) commissioned a survey asking for student information from teachers.  The full report is available at:  https://oipc.sk.ca/assets/lafoip-investigation-211-2019-215-to-241-2019.pdf

The Survey

The STF contracted with a private company called Praxis Analytics to do an online survey of 900 teachers in the province to obtain information related to class load and composition.  Teachers were contacted directly and, as part of the survey, were asked to provide personal information of students such as assessments of work habits, academic performance and social well-being (details of questions asked can be found in the IPC Report).

Upon learning of the survey, Saskatchewan school divisions instructed their teachers not to complete the online survey because it requested students' personal information.

Soon after, the STF and Praxis Analytics disabled the online survey and Praxis Analytics destroyed all the data that had been collected.

The Investigation

The IPC found two root causes of the privacy breach.

1. Some teachers trusted that the STF had done its due diligence in designing the survey. Therefore, the teachers completed the survey without considering whether completing the survey would be in violation of privacy requirements.
2. The STF and Praxis Analytics neglected to do a Privacy Impact Assessment (PIA) when designing the survey.

The IPC provided recommendations for further action for both the STF and for school divisions.

No Expectation of Possible Harm

The Northwest School Division was not involved in the survey process and does not know what data was collected by Praxis Analytics. However, because the data was quickly destroyed and the online survey disabled as soon as the breach was discovered, the division does not expect any harm to come to individual students as a result of the privacy breach.  

Future Commitments from Northwest School Division

The school division regrets that this incident occurred.  The school division is therefore taking the following steps to prevent similar privacy breaches in the future:

1. We will review our policies and procedures, and create new ones if necessary, to make it clear that teachers and all other staff cannot share student information with any person or organization, except as allowed by school division policy.

2. We will review, and increase if necessary, the privacy training we provide for all staff to ensure that all staff understand how personal information of students must be handled.  

3. We will require all staff to confirm in writing every year that:

• they understand the division's policies and procedures regarding privacy; and
• they understand that they must comply with the policies and procedures or be subject to potential discipline. 

4. We have a staff member who is the LAFOIP Coordinator for the School Division. The Coordinator is responsible for ensuring that the school division is complying with privacy and access laws.

• We will ensure that all staff know how to contact the LAFOIP Coordinator.

We will encourage staff to contact the LAFOIP Coordinator for guidance if they have questions about privacy issues.