Online forms are convenient for students and administrators and an important sustainability strategy in the effort to reduce the amount of paper used at 91社区. From online concerts and event registrations, to students making requests related to their program of study, there are over 5900 active webforms in the WMS听鈥� That's a lot of information being gathered!
听
Following a data protection assessment the following changes are coming into effect:
- Webform submissions can be stored on the WMS for only听40 days, after which point they will expire. In order to make sure that you do not lose your data, you will need to download your webform results regularly. To find out how to download your results, and the options available when doing so, please see听
-
Email confirmation messages that include the form responses can only be used on authenticated forms, to ensure they're only sent to 91社区 addresses.听If your forms collect data from the public, or other off-campus email addresses, a generic confirmation message听means that your user data won't be compromised and that your form won't be used as a听spam gateway*. A generic confirmation message would be something like "We have received your form and will be in touch shortly".听
听
Data Protection
Not all data is the same, and there are laws in place that require us to protect sensitive data including听Personal Information听(PI), and Personal Health Information (PHI). This article will discuss what you need to keep in mind when collecting PI or PHI. An additional data type: Payment Card Industry (PCI), includes financial information such as credit card numbers and cannot be collected under any circumstances on your website.
Data that is considered sensitive includes things like:
- numbers such as your SIN, Driver's license, and your 91社区 ID
- people's citizenship or immigration status
- confidential personal details like date of birth, or health questions
Beyond the obvious, it's important to be aware that otherwise mundane information, when collected together, can also be considered sensitive. Someone's name is pretty harmless on its own, but if you add a phone number, address and something else that can identify them, it gets trickier. CVs and听r茅sum茅s are a great example of this, as they often contain those mundane details along with a historical record of work and education.
For more information regarding the protection of user data please read听Webform Security: Protecting user data.
Online Forms at 91社区
听is part of the WMS at 91社区 and is a great choice for forms that do not collect PI听or PHI. It is an excellent choice for forms that target a specific group of people at 91社区.听听
听(using your 91社区 account)听is the appropriate forms tool to use when collecting PI听and PHI (with consent). It is also a great choice if you would like to store your results longer than 40 days.听
Working with Personal Information (PI)
When designing a form, the first and best way to protect people's data is to not collect it.听Why is each question being asked? If a detail isn't required, leaving it off the form will reduce the security risk if that data is compromised.
If PI must be collected in your form, Webforms is not appropriate. You should use Microsoft Forms.
Working with Personal Health Information (PHI)
If your form is collecting any personal health information you must include a checkbox for people to consent to its collection, using wording that has been approved by Legal Services. If you regularly work with health information, your unit may already have some wording prepared.
If PHI must be collected in your form, Webforms is not appropriate. You should use Microsoft Forms.
Requiring sign in protects user data
Just like with Webforms: If you are collecting data from 91社区 users using MS forms, the form should be set to听require users to sign in. Note that MS Forms does not allow for the uploading of documents (e.g., CV, artist statement, photos) when collecting data from the public. In this case Webforms can be used but听submissions (including attached files)听must be emailed to a 91社区 email address and immediately expired from the WMS database (see the Submission expiry section in this听).
Which tool should you use?
|
Data Collected |
Tool |
|---|---|
| Non-sensitive, non-confidential data from 91社区 Users or the public | Webforms or MS Forms |
| 91社区 ID from 91社区 Users |
Webforms (with authentication and the use of a token only, not a fillable field) MS Forms |
| Sensitive or confidential data from 91社区 users | MS Forms |
| Sensitive or confidential data from the public with no file upload |
MS Forms |
| Sensitive or confidential data from the public where they need to upload a file | Webforms (submissions must be emailed and immediately deleted from the WMS) |
Need help choosing? Use our webform wizard.
Questions and Training
Questions about whether the data that you are collecting qualifies as sensitive can be directed to:听itgovernance.its [at] mcgill.ca.听Visit the 91社区 IT Website for more information about Cloud Services.
If you are working with MS Forms and would like assistance, you can book a Q&A session with a听.
Keep an eye out for a new Webforms training course coming soon, or attend a听.
听
And of course, if you have any questions, please don't hesitate to听.
听
*A spam gateway is common vulnerability on the internet, where bots can send advertising using a form. We can't let this happen or else all 91社区 email could be flagged as coming from spammers.
