Privacy

Accountability

The Freedom of Information and Protection of Privacy Act (FIPPA) governs EQAO’s management of personal information. FIPPA requires the agency to protect the personal information in its possession.

The Information and Privacy Commissioner oversees government organizations’ compliance with the access and privacy provisions of FIPPA by investigating privacy complaints and hearing appeals regarding access decisions made by ministries or agencies.

Security

EQAO’s security practices are continually evolving to ensure that the integrity and confidentiality of its online information and systems are maintained. The government uses up-to-date security safeguards to protect its networks and websites from misuse, alteration, copying, disclosure, damage, destruction, monitoring or unauthorized sharing of information. The government’s safeguards include the use of security software and encryption protocols and involve physical, technical and procedural controls to protect information behind our firewalls.

Web Analytics

In order to serve you better, EQAO uses Google Analytics and other tools to help analyze the use of our website. These tools use cookies to collect and generate information about your visits to our website, which is then collected and used in an anonymous form for processing. EQAO also uses server logging for web requests (server logs trace the number and source of incoming web requests in a given period of time, mainly for security purposes, e.g., to trace likely viruses, and to determine traffic patterns). EQAO studies patterns of website activity to improve the experience of visitors to its website. The use of these tools does not allow EQAO or analytics service providers to identify individuals.

You can opt out of analytics activity by setting your browser to notify you when a cookie is sent and block analytics cookies if desired. Please consult your browser’s help menu for instructions. Visiting our website with analytics cookies disabled will have no significant impact on your browsing experience. You may also use a VPN to access our site anonymously.

Google currently offers a free Google Analytics Opt-out Browser Add-on. Please note that deleting or disabling cookies (e.g., deleting browser history) may affect the functionality of the opt-out browser.

Information that the EQAO collects via web analytics includes

• IP address of the electronic device used to access our website;
• the city and country where the IP address is based;
• the address of the website from which visitors came;
• the date and time of a visit to our website;
• the type and version of browser used to access our website;
• the name and size of files on our website opened or downloaded;
• keywords entered in our search engine; and
• pages of our website visited.

When you browse our website or download from it, our servers automatically collect limited amounts of information for traffic, monitoring and statistical purposes. The information is analyzed for operational trends, performance and for ways to improve our website. EQAO cannot identify you from this information.

Personal Information Provided for Feedback

You may choose to provide us with personal information such as your name, address, phone number or e-mail address if you wish to submit an e-mail message, comment, question or request. When you visit EQAO’s website, any personal information you provide will be used to respond to your message and/or provide you with the requested information. EQAO collects your personal information in this regard in accordance with section 38(2) of FIPPA. This section requires EQAO to collect only the personal information that is necessary for the proper administration of EQAO’s authorized business activities. All personal information that is collected, used or handled will be treated in accordance with FIPPA and any other applicable law at all times.

Questions?

Questions or comments regarding these practices can be directed to the Director of Corporate and Public Affairs, EQAO, 2 Carlton Street, Suite 1200, Toronto, ON M5B 2M9 1-888-327-7377.

1.0 Application of General Data Protection Regulation (GDPR) and Legal Basis for Processing

1. This notice applies to all Personal Data of European Union (EU) data subjects processed by EQAO when assessments are conducted of students attending Ontario schools located in the EU or of students attending Ontario schools but residing in the EU at the time that they undergo an assessment.
2. ​​​EQAO is the data controller, within the meaning of the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as the “General Data Protection Regulation” or the “GDPR”), responsible for the processing of your Personal Data.
3. EQAO has appointed a Data Protection Officer (DPO), who takes responsibility for Office’s ongoing compliance with this notice and Office’s privacy practices. EQAO’s Chair of the Board (or delegate) acts as the DPO and can be contacted at 1-888-327-7377 or [email protected] if you have any privacy-related questions or concerns regarding your Personal Data.

2.0  Lawful Processing and Data Subject Rights

1. EQAO’s legal basis for processing Personal Data is to meet its legal obligations as set out under the Office’s objects outlined in clause 3 of the EQAO Act.
2. ​​​Vretta Inc. is EQAO’s data processor for digital assessments, administering tests and compiling test results on behalf of EQAO. Information about Vretta’s GDPR-compliance initiatives and how to exercise your data subject rights, such as gaining access to your Personal Data, can be found on Vretta’s website. Any such requests shall be dealt with in a timely manner.
3. All Personal Data collected in the context of student assessments administered in the EU by EQAO is transferred internationally and stored on Canadian data servers.
4. EQAO shall ensure that Personal Data is accurate, relevant and limited to what is necessary for the purposes for which it is processed, as outlined in EQAO’s Notice of Collection.
5. Since EQAO requires Ontario schools to provide Personal Data to EQAO, administer tests and report on test results to the Office and to the general public, as outlined in s. 4(1) of the EQAO Act, automated decision making undertaken in the scoring process is authorized by law. EQAO does not engage in profiling of data subjects and has suitable measures in place to safeguard data subjects’ rights, freedoms and legitimate interests. For example, all research is undertaken on de-identified data and reported to the Ministry of Education as aggregate data for statistical purposes.
6. EQAO may issue directives regarding the circumstances in which a student need not take a test as set out in s. 4(3) of the EQAO Act. Accommodation and accessibility options are outlined in the User Guides for the OSSLT and Grade 9 Assessment of Mathematics, or by contacting [email protected].

3.0 Privacy Complaints and Breaches

1. In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, EQAO shall promptly assess the risk to data subjects’ rights and freedoms and if appropriate report the breach to the relevant EU Member State data protection regulator

If you are an EU data subject and believe EQAO is not in compliance with the GDPR, you may lodge a complaint with your national Data Protection Authority. The authority will investigate and inform you of the progress or outcome of your complaint within 3 months.