Page Content
A number of popular online applications used in Canadian classrooms are falling short of fully protecting the privacy of young users, according to a recent sweep by the Office of the Privacy Commissioner of Canada.
A review of more than two dozen apps and platforms found that many service providers are, in fact, carefully considering the needs of younger users when it comes to privacy, but others are not.
“We were pleased to find that many of the apps we looked at are taking important steps to protect the privacy of children and youth, for example, by offering kid-friendly explanations about why personal information is being collected,” said Privacy Commissioner Daniel Therrien in a news release.
“Unfortunately, we also found cases where educational apps need to do better. We were concerned to find cases where websites encouraged students to provide more personal information than was actually necessary.”
The review involved “sweepers” that examined the apps’ privacy policies, the personal information being collected, and the controls in place to protect personal information.
Some of the key findings of the sweep:
- Most services made information about how they handle personal information available to users, but the quality varied and it was sometimes hard to find.
- More than a third of the services did not seek consent from students or parents, or provide teachers with resources for obtaining parental or student consent in other ways.
- Only a handful of services had different consent mechanisms for younger and older students.
- Some services had adopted good practices to minimize the collection and disclosure of students’ personal information and provide controls for teachers and parents to set age-appropriate limits/supervision on collection and disclosure of students’ personal information. However, there were cases where too much personal information was collected – for example, a blogging platform designed for use in schools that had fields to collect students’ instant messaging handles, photos and bios.
- Many services failed to make it easy — or even possible — to delete personal information that was no longer needed.
The privacy sweep was the fifth annual by the Global Privacy Enforcement Network and involved 24 data protection regulators from around the world. This year the federal commissioner’s office worked alongside the Ontario Information and Privacy Commissioner’s Office to examine privacy issues related to educational applications targeted at children and youth from kindergarten to Grade 12.
The sweep was not an investigation, nor was it intended to conclusively identify compliance issues or possible
violations of privacy legislation. Rather, sweepers sought to replicate the consumer experience by spending a short time on websites and apps to record certain privacy practices in relation to a common set of indicators.
The initiative is aimed at encouraging organizations to comply with privacy legislation and to enhance co-peration between privacy enforcement authorities. Concerns identified during the sweep will result in follow-up work such as targeted education, outreach to organizations and/or enforcement action. ❚
