As technology becomes more embedded in education, school boards face a question that goes beyond whether they are legally allowed to use a particular tool: are they adequately governing how technology operates?
A recent Information and Privacy Commissioner (IPC) investigation offers an example. In Privacy Complaint MR23-00093 (Waterloo Catholic District School Board (Re), 2026 CanLII 76666 (ON IPC)), a parent noticed that student names and email addresses would auto-fill while composing emails on a personal device shared with her child. The Waterloo Catholic District School Board (the “Board”) reported the incident to the IPC.
The IPC investigator found that the Board's collection was permitted under the Municipal Freedom of Information and Protection of Privacy Act; however, giving every authenticated user access to the entire directory was inconsistent with data minimization. By letting the directory feed third-party email applications without adequate safeguards or user guidance, the Board had not taken the required reasonable measures against unauthorized access. While the Board argued that creating, configuring, testing, and regularly updating sub-directories to reflect staff and student contact information would be an administrative burden – which it had previously considered and rejected – the IPC held that it was the Board’s responsibility to ensure it appropriately used technology, especially through information provided through third-party email applications.
The IPC recommended that the Board implement measures to ensure user information is disclosed only on a need-to-know basis, and revise its internal policies to include guidelines on use of third-party email applications and the safe use of personal devices, and to advise users that parents and guardians may interact with student accounts and therefore have access to personal information provided by the Board.
Ontario's regulatory direction points the same way. Since July 1, 2026, O. Reg. 52/26 under the Enhancing Digital Security and Trust Act, 2024 (EDSTA) has required school boards to give written notice when students' personal digital information goes to third-party software providers. Notice is to be provided to parents/guardians of students under 16, and directly to students aged 16 and 17. It must name, among other things, the information, the legal authority, and the purpose for which information will be disclosed, and the provider to which it will be disclosed. The Ministry of Education expects full implementation by 2027-28. This transparency rule signals that school boards must know how their software collects, uses, and discloses student data, and take proactive steps to ensure such information is handled appropriately.
While the IPC’s decision did not involve AI, its lesson transfers. The same questions arise with greater force as AI features enter digital tools whose outputs may be less predictable or transparent. EDSTA authorizes future regulation of public sector AI, including disclosure, accountability frameworks and risk management. As of today, no such regulation has been made. Meanwhile, the IPC and Ontario Human Rights Commission's January 2026 Joint Principles for Responsible Use of AI, though not binding, signal how regulators and adjudicators may assess future governance and compliance, raising considerations such as validity, reliability, safety, privacy, human rights, transparency, and accountability.
School boards should therefore look beyond authority to practice: how information moves through a tool, where it becomes visible, how connected systems or third-party applications affect that flow, whether safeguards match the risks, and who is responsible when a third-party tool behaves unexpectedly.
Authority to use a technology is the beginning of governance. As AI features arrive in tools schools already use, boards that have practiced asking these questions can ensure they remain at the forefront of student data protection.
About the Author
Shufan Qiu works at the intersection of education law, privacy, and AI governance. She draws on her background in immigration law and experience within post-secondary institutions to bring a practical perspective to institutional decision-making, procedural fairness, and governance. Shufan’s current professional interests include the legal and governance challenges posed by emerging technologies in education, particularly student privacy and responsible AI adoption. She graduated from the University of Toronto Faculty of Law and was called to the Ontario Bar. She serves on the Executive of the OBA’s Education Law Section and is a member of the International Association of Privacy Professionals (IAPP).
Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.