This week, as this article went to press, several major Canadian and American universities announced plans to maintain classes online when the fall semester starts in September. Other universities and colleges are making plans to bring students back to campus physically. Currently, public health orders prohibit in-person classes in Alberta and many other parts of the country.

What Canadian privacy issues will arise for universities, students, faculty and staff in the context of the continuing COVID-19 pandemic? Whether administrators elect to offer the fall semester online, or return to traditional in-class instruction, every institution will face a range of issues that will touch upon privacy concerns. 

On Thursday May 14, 2020, the Alberta government announced that post-secondary institutions may continue course delivery during Stage 1 re-opening. The announcement also included that post-secondary institutions may potentially resume in-person class delivery during Stage 1. However, this depends on whether the existing public health order which prohibits in-person classes is lifted and it’s currently unclear when this can be expected to occur.

“Fit for Return” Screening Protocols

Will students, staff and faculty be required to complete “Fit for Return” or “Fit for Attendance” screening questionnaires?  Will this include mandatory pre-admission medical screenings?

Among healthcare professionals in the hospital and clinical setting, “Fit For Work” screening protocols are commonplace. This process requires hospital or clinic employees to self-report any symptoms related to influenza-like illnesses (ILI) on a daily basis before commencing a shift. In earlier stages of the pandemic daily temperature recording was a feature of this screening in Alberta, although this requirement has since been dropped.  Various screening protocols may become more common across many industry sectors during the relaunch. 

At the National University of Singapore, for example, students are required to declare their fitness to attend campus, and log their temperature online, twice daily. 

Employers can rely on the Personal Information Protection Act in Alberta to collect, use and disclose such information for the purpose of managing the employment relationship. In the case Canada Safeway Ltd. v. United Food and Commercial Workers Union, Local 401 (2005), the Arbitration Board upheld an employer’s right to implement biometric scanning of employees – in that case it was for timekeeping purposes. The arbitrator agreed that the scanning did collect personal information and invaded privacy, but was found not to be intrusive and served a legitimate purpose.

Universities and colleges in Alberta are subject to the Freedom of Information and Protection of Privacy Act which provides for collection and disclosure of personal information in circumstances involving health and safety of individuals, or a health or safety emergency.

Students, of course, would not fall under the employment-related provisions of privacy laws. Best practice is to obtain consent from both employees and students for the collection, use and disclosure of personal health information for the purpose of compliance with public health orders, or to maintain the health of the campus community. Express consent may not always be possible for collection and disclosure of such information, depending on the circumstances.

If such information is collected, the university will have to consider a range of issues:

• Will screening information be collected daily? Weekly?
• From students, faculty and staff? Administrative personnel? Contract workers? Employees of on-campus services such as food services, dining and retail outlets? Campus visitors?
• What modes of collection will be used? Paper forms, online tools?
• Consider the use, storage, and retention of such data. Should aggregate data be available to public health officials, or researchers?  The Health Information Act (Alberta) already provides for research-related exemptions, but at the time of collection, it’s worth considering the current and future uses of such information, and to communicate such policies clearly to the public.
• Consider data security issues and minimal-collection guidelines to mitigate the risks regarding the collection of sensitive personal health information.

Vulnerable Students and Staff

Universities and colleges will likely have to consider the impact of COVID-19 on vulnerable populations, for students, faculty and staff.  This necessarily involves the collection and use of personal health information that, in many cases, would not normally be collected. For example, during normal times, a post-secondary institution would not normally collect information about a student’s pre-existing medical condition. Now, where those medical conditions are associated with a higher risk of severe COVID-19 symptoms, a student may self-disclose that information to the university or the institution may ask students and staff to disclose such information in order to manage the associated health risks for that individual. 

A number of privacy- and risk-related issues arise:

• Is there consensus from public-health authorities on the definition of what constitutes a vulnerable condition?
• What obligations does a post-secondary institution have to discover or inquire about such information?
• If the information is known to the institution, what obligations flow from that knowledge?

The collection, use and disclosure of information about pre-existing medical conditions will trigger a number of privacy-related concerns related to students, faculty and staff.

Academic Assessments

If classes are pushed online for a semester that would traditionally be conducted in-person, students should be made aware of any associated online assessment requirements. Ideally, this would be made known to the students at the time of course registration. 

For example, consider the situation where students are expected to submit to online or remote proctoring for exams. In some cases, online proctoring may be conducted by the institution itself, or third-party services may be used. Personal information will certainly be collected inadvertently where the online proctoring involves surveillance of student exam behavior via webcam and microphone.

Another assessment-related issue may arise where traditional in-person exams are scheduled and a student cannot attend due to a mandated COVID-19 self-isolation rule, or diagnosis. In such cases, will the institution’s existing exam-taking policies be sufficient to address the situation, or will this require COVID-specific provisions to deal with both the privacy of medical information, and the academic approach to the student in question?

Contact Tracing

To detect and manage potential outbreaks, some universities may consider the mandatory use of contact-tracing apps. This again raises questions of personal information collection and disclosure.

Even without the use of mobile apps, traditional contact tracing methods will involve the disclosure of medical conditions that, in many cases, can be traced back to specific individuals even where that individual is not named. For example, if all students are notified that an instructor of Class ABC100 was diagnosed as COVID-positive, then the students will easily deduce the identity of the individual. 

Loosening and Restricting Campus Life

Post-secondary institutions that make the decision to bring students back to campus in September (assuming public health orders permit such activities) will necessarily face the risk of outbreaks, and must consider ‘circuit breaker’ measures throughout the term. Careful planning, advance notice and consent, and clear communication of the rules can help mitigate the privacy risks that will arise during this period.

While all businesses and institutions will have to confront various privacy issues as they continue to deal with the COVID-19 pandemic, the issues faced by post-secondary institutions are unique. Field Law’s Privacy + Data Management Group and Education Group has experience when it comes to handling privacy issues in the post-secondary realm. For assistance in navigating the issues flagged in this article or other privacy related concerns, please contact Richard Stobbe in Calgary.