This is the second post in a blog series that questions the risks that we’re willing to assume and examines the hazards that are present in the current information technology landscape. Although it’s never a one-size-fits-all situation, British Columbia’s current legal framework has a specific provision that affects everyone in the province. You can read the first post, here.
In this blog post, we’re going to review the perspective of those arguing to amend section 30.1 of B.C.’s FIPPA. The Research Universities Council of British Columbia (RUCBC) is, amongst some regional health authorities, arguing to make amendments to the act.
But before we get into that, I want to explain how my interest in a relatively unknown section of a provincial privacy act originated.
Why I care
I’m a UBC student and one day I needed to pick something up from the Enrolment Services Professionals in Brock Hall. So I dropped by and was prepared to wait in a line as I had done on the few occasions that I had been there before. But this time they had a new system called QLess. Instead of waiting in a line, you would input your name and phone number into a computer and receive a text message when it was your turn to be served.
Obviously, this is a better system. But there was a problem. While registering, I noticed that I needed to consent to have my personal information sent into the United States, where the system was hosted. In Canada, our names are considered personal information. I would argue that so should our phone numbers.
Because of section 30.1, UBC was required to ask for consent before sending that information to the U.S., however, because there didn’t seem to be an equivalent alternative to using that system. So: Could I really be giving my consent freely? Or was this an example of what is often called “forced consent”? If so, is this type of consent otherwise not meaningful?
From there, I began wondering how UBC was dealing with section 30.1 in other contexts and I began discovering that it was causing significant difficulties in many settings. What follows, is my investigation into a relatively unknown section of B.C.’s provincial privacy act and its impact on higher education.
Arguments for change
The RUCBC is comprised of the University of British Columbia, Simon Fraser University, the University of Victoria, the University of Northern British Columbia, Royal Roads University, and Thompson Rivers University.
But they’re not alone. B.C.’s health authorities have also joined the fight. So it’s representatives from both the public health and education sectors that are arguing for a change.
UBC counsel for information and privacy, Paul Hancock, on behalf of four other members of the Research Universities Council of British Columbia (SFU was initially absent but later signed on), gave a presentation to a special committee at the provincial legislature whose mandate is to review FIPPA every seven years.
Mr. Hancock’s presentation outlined the arguments for change as the following:
- Administrative efficiency and security
- International engagement and student recruitment
- Online learning offerings
- Academic integrity
Mr. Hancock made that presentation in November of 2015. Although later the special committee and B.C.’s former privacy commissioner both recommended that section 30.1 not be amended. However, last month, in an interview, Mr. Hancock reaffirmed that the RUCBC’s position hasn’t changed and that section 30.1 still needs to be amended.
Let’s have a look at each of the points individually.
Administrative Efficiency and Security
One of the greatest restrictions introduced through 30.1 is the inability to use cloud based computing services. This causes some administrative delays around storing and accessing information through applications that make use of the cloud, like those that deal with payroll and human resource processing.
But Mr. Hancock makes the argument that our current information technology infrastructure that meets the requirements of section 30.1 is less secure than a system that fully encrypts data that’s in motion and still. Meaning, an amendment to 30.1 would mean student data would be more secure than it currently is.
He said that student privacy is at risk from hacking attempts from foreign and state actors with the current system. An amendment to 30.1, according to Mr. Hancock, would mean student data could be kept safer by making the act more intelligent and encouraging higher security.
Additionally, when it comes to attracting faculty to UBC, the limitations that are created from 30.1 impacts the way these world-class educators and researchers are able to work and communicate. Perhaps, Mr. Hancock says, this has an effect on UBC’s international reputation and ability to compete, which brings us to the second the point.
International engagement and student recruitment
It’s no secret that UBC recruits a lot of international students. 14,434 to be exact. These efforts are enabled by proactive strategies led by the International Student Initiative, which sends recruiters all around the world. But because of 30.1, overseas offices and recruiters have difficulties accessing information that needs to be stored on Canadian soil.
What does this mean for students? Likely nothing. But for recruiters, they need to employ complicated systems to circumnavigate or appease section 30.1, but for the everyday student, even international students, there doesn’t seem to be much of an inconvenience.
Online learning offerings
This a big one. UBC, specifically, is relying on outdated technology. Blackboard Connect is the learning management system currently in use at UBC. It’s an outdated, invasive, and clunky system that is patched together to supposedly rival the cloud-based systems that other universities outside of British Columbia can access.
UBC is currently looking at alternatives as the license for Blackboard Connect is expiring. Due to the limitations created by section 30.1, UBC is in a tougher position to find a new learning management system.
Academic integrity
The point relates to the use of an online plagiarism detection service called Turnitin.com. You may not know this, but most universities scan every essay electronically to detect plagiarism. You can implement this quite simply through a built-in version hosted through a learning management system like Blackboard Connect.
However, Mr. Hancock says that UBC can’t use this system because Turnitin, a U.S. company, has the authority to reach into the system and scoop out data at any time, including names and other personal information, which contradicts section 30.1. Therefore, UBC can’t use Turnitin in this way.
There’s a much more complicated, manual way of using the system. This involves having students manually submit their essays through an online portal with the option of using a fake name, but nonetheless their essays, that content, and their IP address (which is the subject of some debate over whether it can be considered personal information) are all travelling outside of Canada.
I’ve also heard of another work-around solution where Teaching Assistants are asked to remove the names from submitted essays, assign a unique identifier, scan them into the system and check for plagiarism, translate the unique identifier back to the name, and then submit them for grading with the instructor. But, as you can imagine, this involves a lot of work and time. You might not be surprised to find out that not all the Teaching Assistants are diligent enough to protect the identities of the students and take shortcuts that sacrifice privacy and contravene the law.
What do you think?
There’s a lot of compelling arguments that have been made for amending section 30.1 of B.C.’s FIPPA. A change would mean that the university would access to an array of new tools and technology that could enhance the learning experience at UBC and increase administrative efficiency. But would be the sacrifice?
In the next instalment of the series, I’ll explore arguments that have been made against amending section 30.1 by an array of concerned parties, including privacy advocates and journalists. Since the act was passed, many have rightfully argued that section 30.1 has only increased in its importance, especially considering the current political situation in the United States.
But based on what you know right now, are you in favour of amending section 30.1?
People said…