Read more on Lexology. It’s not like the school district hadn’t provided any information or disclosure, but what the IPC found was that what the board did was just not enough in terms of its arrangement with the photographer with respect to protection of the student information. As a result, the IPC made recommendations:

  • The agreements should provide that personal information is collected, retained, used, disclosed and disposed of in accordance with the Board’s obligations under the Act;
  • The agreements should explain that the vendor will take reasonable steps to protect the security and confidentiality of this information and ensure its destruction;
  • Personal information should not be retained by the photography vendor for longer than necessary; and
  • Parents/guardians should be clearly informed that they can request the vendor destroy the information so long as it does not interfere with the Board’s administrative requirements.