Privacy and Security

Last updated January 3, 2023

Privacy and Security with Zoom

SFU is prioritizing the security and privacy of all faculty, staff and students while configuring Zoom's system-wide settings, which will be more restrictive to start. As conversations progress and SFU continues adjusting to adopt recommended practices to balance risk mitigation with meeting community needs, changes may occur to the availability of features and functions. Updates will be published on this page as new details are confirmed.

General considerations

• With the recent transition to work-from-home environments for many SFU faculty, staff, and students, please be mindful of the type of content being shared, which is now more likely to include personal environments. Participants have the option of either turning off their camera or using a virtual background to hide their personal environment.
• Anyone recording sessions in SFU Zoom is required to meet our privacy obligations under the Freedom of Information and Protection of Privacy Act (FIPPA). We advise against recording sessions using third-party applications or non-SFU Zoom accounts without attendees’ knowledge and/or consent.
• All recorded content may be subject to a formal access to information request made under FIPPA.
• For added security, you can configure your meetings to allow only users with Zoom accounts to join your meetings. Check out the instructions.

COLLECTION NOTICE

SFU collects your personal information through Zoom under the authority of the University Act (RSBC 1996, c.468) and the Freedom of Information and Protection of Privacy Act (RSBC 1996 c.165), for the purpose of attending, participating in or hosting online video or audio meetings or classes.

The personal information collected includes your display name, which may include your first and last name if you choose to enter them, information about your device, network, and internet connection (e.g., IP address(es), MAC address, device type, operating system, and client version), information about your usage of or the interaction with Zoom products, and other information you upload, provide, or create while attending a Zoom session. Certain lectures, labs, and events may be recorded by SFU. As a result, SFU may collect your image, voice, name, personal views and opinions, and course work to support online student learning and community engagement.

Zoom Video Communications is located in the US with data centres deployed globally. Zoom’s privacy policy is available here. If you have any questions about the collection and use of this information please contact the department hosting the relevant Zoom meeting or for general inquiries, the Access and Privacy Program at privacy@sfu.ca.

Recording meetings in Zoom

Privacy considerations for recording

Notable requirements for compliance with FIPPA include:

• securing stored recordings. Avoid storing records on non-SFU systems (e.g., Google Drive or Dropbox). Consider filing recordings with other related departmental records; do not leave recordings on personal devices.
• On November 12th, 2022, enabling all Zoom data centre regions for meeting and webinar data in transit and data at rest, including Zoom Cloud recordings to improve users' Zoom connection. We still opt out of using the China data centre for our Zoom account. 
• offers optional cloud recording for hosts of all Zoom meetings. All Cloud recordings are stored in SFU Zoom’s new online Canadian data centre. Passcode protection is enforced for all shared cloud recordings. Cloud recordings stored in the Zoom cloud will be deleted 365 days after the meeting date or can be deleted by the host. Local and cloud recording allows the host to record their Zoom meeting's video, audio, transcribed text, and chat transcripts.
• A properly formatted collection notice that clearly defines the business purpose for the collection of personal information, the legal authority for the collection, and the contact information of an SFU officer or employee who can answer questions regarding collection. Zoom does not have any built-in capability of delivering such a collection notice.
• Controlled access. Access to recordings can only be granted to university employees when it is necessary for the performance of their work duties. Sharing of the recordings in the absence of a legitimate business need is not authorized.
• Consistent use. Participants’ personal information can only be used for the purpose for which it was obtained and compiled or for a use consistent with that purpose. Secondary uses of the recordings are not authorized.
• Minimum retention. Recordings containing personal information must be retained for a minimum of one year if they are used to make decisions that directly affect participants. Examples include academic advising sessions, job interviews and exam invigilations.
• Authorized disposal. The University will dispose of recordings only with an approved Records Retention Schedule and Disposal Authority. Departments may or may not have applicable RRSDAs already in place. Visit the Directory of University Records for more information at https://www.sfu.ca/archives2/dur/dur.html.
• A business rationale for the need to record content. Staff meetings, academic advising sessions, job interviews, etc. have not been typically recorded at the University in the past. We strongly advise against recording Zoom sessions for the purposes of administrate convenience or as a means of compiling meeting minutes and notes.

RECORDING ZOOM LECTURES: PRIVACY AND COPYRIGHT GUIDELINES FOR INSTRUCTORS

COLLECTION

Depending on how you run your lectures and the steps students take to anonymize their identities, it is possible that a student's personal information (e.g., name, image, voice, personal views and opinions, course work) may be captured in a recording. Use a collection notice so that your students are aware of the purpose for the collection of their personal information, the legal authority for the collection, and to whom they can direct questions about the collection. More->