IPC concludes investigation into school board’s use of cloud-based data service

The Office of the Information and Privacy Commissioner of Ontario (IPC) has concluded its investigation into the York Region District School Board’s (YRDSB) use of Edsby, a cloud-based data management service.

Edsby, an application that stores and processes student information, is used by the YRDSB under contract with vendor CoreFour Inc. to manage student attendance. The IPC’s investigation parallels an investigation by the Office of the Privacy Commissioner of Canada (OPC) into CoreFour’s practices.

The information collected by Edsby, on behalf of the YRDSB, includes student names, pictures, grade level, teachers, contact information, and attendance information. The IPC found the YRDSB’s use of the Edsby service to manage student attendance complies with Ontario’s municipal privacy law. The YRDSB’s contract with CoreFour also contained reasonable contractual measures to protect the privacy and security of the personal information of its students. However, the board fell short in taking steps to oversee the performance of CoreFour’s security obligations under the contract. The IPC report details the steps the board should take to strengthen and document its oversight of the security measures.

The IPC’s investigation report provides essential guidance to school boards that retain technology service providers to help deliver their education mandates and includes a discussion of the types of security provisions that should be included in their contracts. It also serves as a reminder that boards must complement a strong contract with appropriate monitoring and oversight to fulfill their obligations to protect student privacy.

Children and Youth in a Digital World is one of four strategic priorities the IPC has selected to guide its efforts now and into the future. The goal of this priority is to champion the access and privacy rights of Ontario’s children and youth by promoting their digital literacy and expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.

Media Contact

For a quick response, kindly e-mail or phone us with details of your request such as media outlet, topic, and deadline:

Email: @email
Telephone: 416-326-3965

Contact Us

Social Media

The IPC maintains channels on LinkedIn, X (formerly Twitter), YouTube and Instagram in its efforts to communicate to Ontarians and others interested in privacy, access and related issues.

Our Social Media Policy

Help us improve our website. Was this page helpful?
When information is not found

Note:

  • You will not receive a direct reply. For further enquiries, please contact us at @email
  • Do not include any personal information, such as your name, social insurance number (SIN), home or business address, any case or files numbers or any personal health information.
  • For more information about this tool, please see our Privacy Policy.