OPC finds privacy protections of EdTech company lacking

A Canadian educational technology company used by the York Region District School Board (YRDSB) did not do enough to protect the information of the hundreds of thousands of students who use the service, according to the federal privacy watchdog. In a Thursday release, the federal Office of the Privacy Commissioner said that while the application known as Edsby, which is owned by CoreFour Inc., "had implemented some effective security practices, but had not developed a robust, overarching information security framework." "Such a framework could have potentially avoided the security vulnerabilities identified by the complainant and our office’s own testing. In particular, the investigation identified weak password requirements for certain Edsby parental accounts, and inadequate safeguards to protect against unauthorized access to thumbnail images of student profile pictures," the OPC said in the release. The use of so-called "EdTech" has greatly expanded since the isolation required of the COVID-19 pandemic era, the OPC acknowledges in the release, and the investigation was the first one into the sector conducted by the OPC. The report, which was first shared with the parties in March, stems from a complaint from a parent in the school system. It alleged that the Edsby application did not have adequate privacy standards and accountability under the Personal Information Protection and Electronic Documents Act (PIPEDA); did not have adequate privacy breach reporting mechanisms; had vulnerabilities for passwords and children's images on the site; and failed to obtain direct consent from parents for the use of children's information. "In the case of the password management vulnerability, no actual breach had occurred, and in any event, private sector breach reporting was not yet mandatory when the respondent learned of this vulnerability," the OPC said in its report. It further noted that the only breach of the student image vulnerability came from the respondent, "which did not result in a real risk of significant harm." The OPC did find, however, that the company lacked a privacy management framework. "It did not have appropriate written, internal policies and practices to give effect to PIPEDA principles, such as in relation to complaint handling and data retention and destruction, although certain of these documents were in development during our investigation," the OPC wrote. "Nor did the respondent provide adequate privacy training to its employees, consultants, contractors and students." The OPC also said that CoreFour's own privacy policy was "unclear in certain respects and could be improved" and tha therefore the company failed to meet its obligations under PIPEDA. The watchdog said that the company was co-operative throughout the investigation, and has since introduced malware scanning within the application. The OPC concluded that the complainant's concerns around safeguards and accountability to be "well-founded and conditionally resolved," while other concerns about breach reporting and notification to be "not well-founded." The application, in the OPC's description, provided the school system with a number of different functions, including course content managements, grading systems, group collaboration, timetables and calendars, as well as analytics and notes. The OPC's investigation was released Thursday in conjunction with a parallel investigation by the Information and Privacy Commissioner of Ontario (IPC), which in its own release said it "found the YRDSB’s use of the Edsby service to manage student attendance complies with Ontario’s municipal privacy law." "However, the board fell short in taking steps to oversee the performance of CoreFour’s security obligations under the contract," the IPC said. The IPC called on the school board to require the company to submit to an independent privacy audit and keep stricter records of the company's compliance with privacy measures. — Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

OPC finds privacy protections of EdTech company lacking

Broadcast | May 21, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

OPC finds privacy protections of EdTech company lacking

Broadcast | May 21, 2021

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Privacy commission, CRTC among best PS workplaces, survey finds

Dufresne pledges to continue Therrien’s work as Privacy Commissioner

Philippe Dufresne appointed Privacy Commissioner

New legislation needed to cover growing privacy issues: Therrien

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us