A school provided students’ personal data to an online tool services provider for creating service accounts for students without notifying the parents — DPP3
The Complaint
The complainant’s daughter was a primary school student. Without notifying the parents, the school provided its students’ names, classes and class numbers to the contractor of its online tool for creating user accounts, which were used by students for logging into services provided by the tool such as email, cloud disk and learning applications. Student number and date of birth were used as default log-in name and password respectively. The complainant was worried that the school might keep track of students’ account usage, and that the terms of conditions to be accepted upon logging in might be incomprehensible to primary students. The complainant therefore complained to the PCPD on behalf of her daughter.
Outcome
The school stated that although it had control over students’ accounts and might decide on the services used by students according to teaching needs, it was unable to review students’ account activities. Besides, the school explained that naming service accounts by student name, class and student number could facilitate identification of users by teachers. The setting of date of birth as default password was also done on purpose for easy recall by students. The school stressed that it had required the students to change their account password upon the first log-in.
When parents provided their children’s personal data to the school, they were not informed that the data would be transferred to the contractor of its online tool. In the circumstances, parents’ concern about possible misuse of their children’s personal data was understandable.
After the PCPD explained the relevant requirements under the Ordinance to the school, the school undertook that it would use other combinations of characters to create user account for students. For the existing accounts, parents might choose whether they would keep using them or not. Besides, the school would develop a policy on usage of the online tool, define the purposes of account creation, and publicise account safety and the school’s right to manage the accounts, to alleviate parents’ concern.
(Uploaded in March 2019)