Concerns about the confidentiality of personal data have prompted various school service centres (CSS) in Quebec to turn their backs on the Californian application ClassDojo, used by teachers to communicate with parents.
The CSS des Samares, in Lanaudière, noted “gaps that could potentially put the confidentiality and security of the information of our students and their parents at risk,” explained to the Duty Hélène Duchaine, from the communications department.
The organization removed access to ClassDojo on 1er July, and it is now banning the use of the application. “There was no data leak, but an inconsequential event highlighted the flaws in this application,” justified Mme Duchaine.
At the CSS des Mille-Îles in the Laurentians, ClassDojo is no longer part of the “digital environments” recognized by the organization. “This directive was taken in conjunction with the information security committee in accordance with the principles of Bill 25 and with the aim of reducing the risk of breaches of confidentiality via external platforms,” said communications advisor Mélanie Poirier.
The provisions of the Act to modernize legislative provisions relating to the protection of personal information (Bill 25) came into force in September 2023, with the objective of modernizing the protection of personal information. Foreign companies doing business in Quebec — such as ClassDojo — are subject to it.
ClassDojo is an American application that allows teachers to communicate in writing with parents and share photos or videos. It also allows to highlight the good and bad behavior of students in class, by giving them or taking away points. The interface is used by 50 million teachers in 180 countries.
Based in California, the app has attracted media attention over the years. Experts and columnists have raised concerns about ClassDojo’s potential to collect information about students and their behaviors and share it with third parties. ClassDojo stores student data on Amazon’s cloud — “securely,” its website says.
ClassDojo claims to be compliant with Law 25
In an interview at Duty, ClassDojo’s general manager of trust and safety, Preet Anand, assured that the app is built on the security standards set by the European General Data Protection Regulation (GDPR). Law 25 includes several transparency, consent and disclosure obligations inspired by the GDPR.
“ClassDojo meets the requirements of Bill 25,” Anand said, emphasizing the requirements of informed consent and data management. “We use bank-grade encryption to ensure that all information is transmitted securely. We also have a bug bounty program, where we work with experts to test our systems and prevent unauthorized access,” he said.
Mr. Anand added that the company’s servers, which have been estimated to be worth $1.25 billion in 2022, are in the United States, “which is permitted under Act 25.”
Quebec law does indeed allow information to be stored outside of Quebec, provided that a company ensures that the data “will benefit from adequate protection.” The Ministry of Education, for its part, has not banned the use of ClassDojo in schools. It lets CSSs make their own decision, based on “their own analysis of the needs and risks associated with its use,” summarized spokesperson Esther Chouinard.