By Carys Mills
Nearly 600 Ryerson students will soon be notified that their personal information was made available online for over a month.
A glitch on the Student Administration System (SAS) caused the name, gender, date of birth, student number, mailing address, email address, and social insurance number of students to be available from Nov. 17 to Jan. 9. An estimated 363 students may have viewed the information while they attempted to enroll in classes.
Although Ryerson said there’s no reason to believe the personal information was misused, the soon-to-be-informed students will have the option of taking legal action against the university.
“Students can expect that their information is kept confidential,” said John Judge, a senior partner at Stikeman Elliot, a business law practice in Toronto. According to Judge, students have two options.
First, they can put in a complaint to the Information and Privacy Commissioner of Ontario. Judge said this option “doesn’t offer a lot of relief to students.”
A complaint to the commissioner could lead to an investigation to discover whether there was any wrongdoing and whether changes need to be made to the collection of information. The university informed the office of the commissioner as standart protocol when they discovered the glitch.
Judge said students’ second option, filing a class action against Ryerson, isn’t without its challenges either. A class action lawsuit would only need one student or a small group of students to represent the group of students affected. The main challenge is Ontario’s privacy legislation, which isn’t as clear as legislation in places like England or Australia. Judge said negligence in cases involving car accidents, for example, is more straightforward.
“The reality is that protection of privacy isn’t as strong as one might think in Ontario,” said Judge.
Students would first need to find a lawyer who’s willing to prove Ryerson breached their obligation of confidentiality. Judge thinks finding a lawyer within Toronto is possible.
He said students should deal directly with Ryerson because students handed over their information to the university, rather than with the software company PeopleSoft that runs the SAS. He said Ryerson may choose to take legal action against PeopleSoft because of the glitch.
Jonathan Davis-Sydor, a lawyer with Davis LLP in Toronto, said students probably don’t have a case unless they can prove their information was misused. They would need to prove fraud occurred because of Ryerson’s negligence.
Davis-Sydor said he was unaware of similar cases involving post-secondary institutions. Although the combination of social insurance number and date of birth makes fraud possible, cases directly involving credit card information are more likely to result in fraud.
Leave a Reply