Produced by the Secretariat in consultation with Legal and Immigration Services and the Office of the
Associate Vice-President, Academic (22 May 2020)
Scope and Purpose
For many instructors, the shift to remote teaching is new. This new way of sharing course content and interacting with students has understandably prompted questions, not only about how to do the foregoing in an effective way given the challenging context, but also the implications for privacy.
This document provides guidance to Faculties on managing privacy concerns while teaching remotely. Though prepared as a response to new digital assets (i.e., records) created as part of remote teaching during the COVID-19 crisis, the guidance is applicable in general.
Statutory and Policy Requirements
Universities are required to comply with the provisions of the provincial Freedom of Information and Protection of Privacy Act (FIPPA), so the University of Waterloo must collect, use, maintain, disclose and dispose of personal information in a manner consistent with the legislation. Information within the institution is also managed in accordance with University policy and guidelines.
As care must be exercised to protect privacy while engaging in remote teaching and learning, Faculties should be familiar with the following:
Privacy Guidelines for Instructors
Instructors may choose to record academic activities such as lectures, tutorials, or labs. This might consist of: (1) pre-recorded teaching content (created by instructors) including asynchronous lectures, short lecture segments, or lab demonstrations) that can be viewed by students at any time; (2) pre-recorded learning content (created by students) including oral presentations, group discussions, or oral examinations; and (3) recordings that occur while students take part in live-streamed (synchronous) course activities.
Except for pre-recorded teaching content created by instructors, the above-named activities may put students in the position of having their information recorded in a number of ways, either with their direct participation (e.g. video, audio, chat) or through indirect means (i.e. online identifier, such as name or telephone number). These conditions raise privacy concerns that should be taken into account. Before engaging in any such recording activity, instructors must have considered the following:
Need for recording:
- Instructors should confirm that recording is necessary for the course in that student evaluation cannot feasibly occur in the absence of recording (e.g., grading is based on class participation within the full class or break-out groups, and/or oral examinations and/or another requirement to evaluate student performance in real-time).
- Unless necessary, individual student consultations (such as those which typically takes place during office hours) should not be recorded. If such recording is to take place, then all participants must be provided notice of recording and be presented with opportunity to attend a different non-recorded office hours or student consultation session.
Notice of recording:
- If a course includes recording, instructors should display a Notice of Recording (see Appendix). This notice should be prominently displayed within the Learning Management System being used (e.g. LEARN) and instructors should also describe any recording activities at the outset of the course (e.g., within the course syllabus, on a course website, etc.) and at the first instance of activity that is expected to be recorded. A downloadable Notice of Recording Template is stored on the Keep Learning website.
- It should be clear to students which specific activities are being recorded (and the purpose/nature of the recording), and which that are not.
- If it is necessary to record an event throughout the course of the term and where this had not been previously communicated, then students should receive as much advanced notice of recording as possible.
- Consider a variety of options for students. Students who do not wish to be recorded, those in a significantly different time zone, those who do not have the technological means to participate, or those who would be disadvantaged in any way by video/audio recording, should be offered an alternative method of evaluation without penalty.
- To ensure an equivalent learning experience for all, any live streamed lecture or tutorial that has been recorded should be hosted in a secure place that allows easy access so that students who were unable to attend a live stream event can review the recordings. The University of Waterloo’s learning management system (LEARN) is one suitable choice. For other acceptable storage options, the instructor should contact firstname.lastname@example.org.
- For audio recording, the student has the option to use a pseudonym (with the exception of identifying themselves to the instructor).
- For more information about accessibility, students should be directed to connect with Waterloo’s AccessAbility Services.
Policies and guidelines:
- Recordings are subject to the Freedom of Information and Protection of Privacy Act (FIPPA), as well as University policies and guidelines.
- Recordings may only be used for the purpose for which they were obtained or compiled as reflected in the Notice of Recording.
- While students are permitted to record events for personal use to facilitate their learning and preparation of personal course/lecture notes, the URL of an event or an event session recording or copies of recording are not permitted to be disclosed to anyone, without the permission of the course instructor or event organizer. The URL should be available only to authorized participants who have been directly provided the link, along with instructions for its use. Students should review the University guideline Faculty, Staff and Students Entering Relationships with External Organizations Offering Access to Course Materials for more information on their obligations with respect to keeping copies of course materials.
Storage and disposal:
- Recordings should not be stored long-term on an instructor’s personal device, even if that device has been safeguarded through encryption and password protection (which is the University’s expectation of use of portable devices for University business). See Guidelines on use of Waterloo Computer and Network Resources. Over time, recordings that are being stored on personal devices may be forgotten which then can pose a risk for inadvertent access or disclosure of personal information.
- Recordings are University records and must be kept in accordance with WatClass, the University Records Classification and Retention Schedules, then securely disposed of when they are no longer needed by the University. Specifically, the recordings are classified with the TL38 – Online Courses records retention schedule.
- The disposal of University records should be documented using the University records destruction form or equivalent documentation. Documenting the disposal of records is a requirement of FIPPA, for records like recordings of students which contain personal information, and of Policy 46 – Information Management.
Limitation and Risk:
- Recording is not without limitation and risk which may include: (1) limitations to ensuring privacy security of information despite reasonable efforts; (2) unauthorized copying and disclosure, disclosure as required by law; and (3) introduction of malware into computer system, which could potentially damage or disrupt computer, networks, and security settings. The University is not responsible for connectivity/technical difficulties or loss of data that is associated with the student’s hardware, software, or Internet connection.
Communicating Privacy Information to Students
When course activity involves recording, instructors should ensure that students have been made aware of this privacy guidance, especially the information contained within the sections immediately above, including: (1) Notice of recording, (2) Alternatives, (3) Policies and guidelines, (4) Storage and disposal, and (5) Limitation and risk.
Concluding Remarks: Using Caution
When recording, ensure that:
- You are familiar with the platform being used, including guidance on how to enable security and privacy safeguards. Assistance and resources for this can be accessed through Keep Learning;
- You do not enable recording on the platform by anyone other than yourself;
- Only invited participants who have chosen to join an event are being recorded;
- Be aware of what is in your background - have a plain background as much as possible or blur your background. If your surroundings can be seen, then have a “clean” work area so that personal objects (e.g., family photographs, etc.) are minimized; and
- Be mindful of how you communicate. Communication should be topical, focused on course content, and individuals should refrain from divulging the personal information of others. Individuals should also be aware of the possibility, when divulging personal information about themselves, that the recording may become more widely available than anticipated: for example, if included in an information access request.
Questions or Concerns
If you have questions about the above guidance, or if you have additional questions about protecting University records containing personal information or about our responsibilities under Freedom of Information and Protection of Privacy legislation, please contact Kathy Winter, Assistant University Secretary and Privacy Officer.
For questions specific to remote teaching and learning, students should be directed to speak to their instructor, and to access resources through Keep Learning. Instructors should contact email@example.com.
Notice of Recording Template - This template is for instructors to download, complete, and provide to students via LEARN, course syllabus, course website, etc.
Remote Teaching and Learning: STUDENT NOTICE OF RECORDING
Activities for this course involve recording, in partial fulfillment of the course learning outcomes. You will receive notification of recording via at least one of the following mechanisms: within the Learning Management System (LEARN), a message from your course instructor, course syllabus/website, or other means. Some technologies may also provide a recording indicator. Images, audio, text/chat messaging that have been recorded may be used and/or made available by the University to [insert to whom1] for the purpose of [insert purpose2]. Recordings will be managed according to the University records classification scheme, WatClass, and will be securely destroyed when no longer needed by the University. Your personal information is protected in accordance with the Freedom of Information and Protection of Privacy Act, as well as University policies and guidelines and may be subject to disclosure where required by law.
The University will use reasonable means to protect the security and confidentiality of the recorded information, but cannot provide a guarantee of such due to factors beyond the University’s control, such as recordings being forwarded, copied, intercepted, circulated, disclosed, or stored without the University’s knowledge or permission or the introduction of malware into computer system which could potentially damage or disrupt the computer, networks, and security settings. The University is not responsible for connectivity/technical difficulties or loss of data associated with your hardware, software or Internet connection.
By engaging in course activities that involve recording, you are consenting to the use of your appearance, image, text/chat messaging, and voice and/or likeness in the manner and under the conditions specified herein. (In the case of a live stream event, if you choose not to have your image or audio recorded, you may disable the audio and video functionality (see: Student privacy during live events). Instructions to participate using a pseudonym instead of your real name are included where the feature exists; however, you must disclose the pseudonym to your instructor in advance in order to facilitate class participation.) If you choose not to be recorded, this notice serves as confirmation of your understanding that [indicate alternative action that students can take3].
You are not permitted to disclose the link to/URL of an event or an event session recording or copies of recording to anyone, for any reason. Recordings are available only to authorized individuals who have been directly provided the above instructions/link for their use. Recordings for personal use, required to facilitate your learning and preparation of personal course/lecture notes, should not be shared with others without the permission of the instructor or event coordinator. Review the University’s guidelines for faculty, staff and students entering relationships with external organizations offering access to course materials for more information on your obligations with respect to keeping copies of course materials. For more information about accessibility, connect with AccessAbility Services.
1 Insert to Whom - Name the course, and who has access, such as professor, classmates, project group, teaching assistants, etc.
2 Insert Purpose - This might include: for materials review, for assessment, etc.
3 Insert Alternate Action - This might include: asking students to view the recording later and ask questions in the discussion forum; instructions may be provided in the assignment, in this document, or elsewhere.