Online forms are convenient for students and administrators and an important sustainability strategy in the effort to reduce the amount of paper used at Â鶹AV. From online concerts and event registrations, to students making requests related to their program of study, there are over 5900 active webforms in the WMSÌý– That's a lot of information being gathered!
Ìý
Following a data protection assessment the following changes are coming into effect:
- Webform submissions can be stored on the WMS for onlyÌý40 days, after which point they will expire. In order to make sure that you do not lose your data, you will need to download your webform results regularly. To find out how to download your results, and the options available when doing so, please seeÌý
-
Email confirmation messages that include the form responses can only be used on authenticated forms, to ensure they're only sent to Â鶹AV addresses.ÌýIf your forms collect data from the public, or other off-campus email addresses, a generic confirmation messageÌýmeans that your user data won't be compromised and that your form won't be used as aÌýspam gateway*. A generic confirmation message would be something like "We have received your form and will be in touch shortly".Ìý
Ìý
Data Protection
Not all data is the same, and there are laws in place that require us to protect sensitive data includingÌýPersonal InformationÌý(PI), and Personal Health Information (PHI). This article will discuss what you need to keep in mind when collecting PI or PHI. An additional data type: Payment Card Industry (PCI), includes financial information such as credit card numbers and cannot be collected under any circumstances on your website.
Data that is considered sensitive includes things like:
- numbers such as your SIN, Driver's license, and your Â鶹AV ID
- people's citizenship or immigration status
- confidential personal details like date of birth, or health questions
Beyond the obvious, it's important to be aware that otherwise mundane information, when collected together, can also be considered sensitive. Someone's name is pretty harmless on its own, but if you add a phone number, address and something else that can identify them, it gets trickier. CVs andÌýrésumés are a great example of this, as they often contain those mundane details along with a historical record of work and education.
For more information regarding the protection of user data please readÌýWebform Security: Protecting user data.
Online Forms at Â鶹AV
Ìýis part of the WMS at Â鶹AV and is a great choice for forms that do not collect PIÌýor PHI. It is an excellent choice for forms that target a specific group of people at Â鶹AV.ÌýÌý
Ìý(using your Â鶹AV account)Ìýis the appropriate forms tool to use when collecting PIÌýand PHI (with consent). It is also a great choice if you would like to store your results longer than 40 days.Ìý
Working with Personal Information (PI)
When designing a form, the first and best way to protect people's data is to not collect it.ÌýWhy is each question being asked? If a detail isn't required, leaving it off the form will reduce the security risk if that data is compromised.
If PI must be collected in your form, Webforms is not appropriate. You should use Microsoft Forms.
Working with Personal Health Information (PHI)
If your form is collecting any personal health information you must include a checkbox for people to consent to its collection, using wording that has been approved by Legal Services. If you regularly work with health information, your unit may already have some wording prepared.
If PHI must be collected in your form, Webforms is not appropriate. You should use Microsoft Forms.
Requiring sign in protects user data
Just like with Webforms: If you are collecting data from Â鶹AV users using MS forms, the form should be set toÌýrequire users to sign in. Note that MS Forms does not allow for the uploading of documents (e.g., CV, artist statement, photos) when collecting data from the public. In this case Webforms can be used butÌýsubmissions (including attached files)Ìýmust be emailed to a Â鶹AV email address and immediately expired from the WMS database (see the Submission expiry section in thisÌý).
Which tool should you use?
|
Data Collected |
Tool |
|---|---|
| Non-sensitive, non-confidential data from Â鶹AV Users or the public | Webforms or MS Forms |
| Â鶹AV ID from Â鶹AV Users |
Webforms (with authentication and the use of a token only, not a fillable field) MS Forms |
| Sensitive or confidential data from Â鶹AV users | MS Forms |
| Sensitive or confidential data from the public with no file upload |
MS Forms |
| Sensitive or confidential data from the public where they need to upload a file | Webforms (submissions must be emailed and immediately deleted from the WMS) |
Need help choosing? Use our webform wizard.
Questions and Training
Questions about whether the data that you are collecting qualifies as sensitive can be directed to:Ìýitgovernance.its [at] mcgill.ca.ÌýVisit the Â鶹AV IT Website for more information about Cloud Services.
If you are working with MS Forms and would like assistance, you can book a Q&A session with aÌý.
Keep an eye out for a new Webforms training course coming soon, or attend aÌý.
Ìý
And of course, if you have any questions, please don't hesitate toÌý.
Ìý
*A spam gateway is common vulnerability on the internet, where bots can send advertising using a form. We can't let this happen or else all Â鶹AV email could be flagged as coming from spammers.
