Retention of Student Identifiers Procedure

The Information and Privacy Commissioner of Ontario (IPC) has recommended that the DDSB stop collecting personal information that is not necessary to fulfil our educational mandate. This specifically includes students’ health card numbers, social insurance numbers (SIN), and insurance policy numbers. Collecting or storing 
these identifiers in Board systems is generally not permitted unless there is a clear, lawful, and necessary Board purpose.

The DDSB has already taken steps to clarify expectations in this regard through the new Records and information management (RIM) Policy (P GOV 10), Procedure (PR GOV 10-01), and Records Retention and Classification Schedule (RRCS). These documents confirm that staff are to: only collect what is necessary, store and share information appropriately, and not delete or dispose of records outside approved DDSB processes.

The Chief Executive Officer is responsible for the development, implementation and monitoring of this procedure developed to support Board policies and compliance.

This procedure applies to all DDSB staff involved in the collection, storage or use of student information. 

4.1 Staff shall not:

1. enter or store restricted identifiers in PowerSchool, other DDSB systems, or hardcopy records unless there is written direction from the DDSB and an approved process for doing so. Restricted identifiers 
   include: 
   • health card/OHIP numbers
   • social insurance numbers 
   • insurance policy numbers 
   • passport numbers 
   • driver’s license numbers 
   • immigration document numbers, 
   • any other government-issued or external identifying number not approved for the purpose
2. place restricted identifiers anywhere in DDSB systems or platforms.
3. create local forms, spreadsheets, trackers, lists, binders, or shadow records that collect or store restricted identifiers unless there is written direction from the DDSB and an approved process for doing so.
4. enter any personal information into any DDSB system or platform unless it is necessary for a legitimate DDSB purpose. If staff cannot clearly explain why the DDSB needs the information to deliver education or a required support service, the information shall not be collected or entered it into any DDSB system or platform.

4.2 Staff are to use approved student identifiers only. For the DDSB, this includes DDSB/PowerSchool student number, the Ontario Education Number (OEN), and approved education partner or program-specific numbers where required for authorized DDSB purposes. 

4.3 Staff shall not collect vaccination information/status from families/pupils nor store any such information that may be provided by families/students. 

4.4 The prohibitions set out above apply equally to “temporarily” collection and/or retention such as in PowerSchool notes, custom fields, attachments, scanned forms, PDFs, photos, spreadsheets, emails, Teams/SharePoint folders, shared drives, local drives, or school-created trackers. 

4.5 In the case of finding information stored electronically outside the scope of what is permitted under this procedure, staff should not copy, move, edit, redact, or destroy the information unless through an approved process. Removal of such information must be coordinated to ensure records are handled consistently, securely, and in accordance with privacy, FOI, the Records and information management (RIM) 
Policy (P GOV 10), Procedure (PR GOV 10-01), and Records Retention and Classification Schedule (RRCS). Report any such issue by email to: Privacy Office: foi.privacy@ddsb.ca; Corporate Records: records@ddsb.ca; and PowerSchool Support / IT Service Desk for guidance on safe removal/clean-up.

4.6 If a school form or local process contains fields for the collection of prohibited information, staff shall stop using that version immediately and contact their FOS Superintendent to update the form/process.

• Records and Information Management (RIM) Policy (P GOV 10)
• Procedure (PR GOV 10-01)
• Records Retention and Classification Schedule (RRCS)