Zoom Privacy & Security Guidelines at BCIT (November 2022)

BCIT takes the protection of privacy and information security very seriously. You can protect the privacy and security of participants in meetings as well as protect confidential information by following these guidelines.

Regardless of the method of video collaboration, BCIT policies and procedures must be followed including but not limited to: Policy 1500 Code of Conduct, Policy 5102 Student Code of Conduct, Policy 6700 Freedom of Information and Protection of Privacy, and Policy 3502 Information Security.

For instructions about using Zoom, refer to Using Zoom in the BCIT Knowledge Base.

Due to changes in Zoom’s data centre location and BC’s privacy legislation, we are finally able to turn on cloud recording as an ability for all users on November 23, 2022. For Faculty, this option will replace local recording. For all other employees this is new functionality. Check the Zoom FAQ article for contextual information, see the instructions for using the new functionality, and read about security and privacy implications and settings for the new functionality.

Tips for all Zoom meeting users

1. Protect meeting links

The most common cause of privacy or security breaches with Zoom is also the simplest: sharing a meeting link with individuals who should not have access to it. As a general rule, don’t post meeting links where the general public can find them, and don’t share meeting invites with those who were not on the original invite list.

2. Protect BCIT private information

Close business applications which could contain private and or sensitive information before joining meetings or sharing your screen. Even if you have them minimized, notifications from applications like Outlook can unintentionally and unexpectedly reveal private information. If you are sharing your screen to show a document or application, share the specific application rather than your entire screen, which further limits the possibility of unintended security breaches.

3. Protect the privacy of the people around you

If you are sharing your workspace with others (family members, housemates, coworkers, etc.), protecting their privacy is also important.

Mute yourself when joining a meeting (you can set this as a default in the Zoom app) and whenever you are not speaking.
If possible, use a headset or directional mic to limit the amount of ambient noise that can be heard by others in your meeting.
Consider your workspace and, if possible, ensure that those around you aren’t unintentionally visible in video. If this isn’t possible, turn off your own video in meetings.
If possible, use Zoom’s virtual background feature to hide your surroundings.

Tips for meeting hosts & organizers

1. Protect meeting links

This is still the most critical tip of all and so bears repeating here. Don’t post or share meeting links where they can be seen or used by those who should not be in the meeting. Remind your participants not to share the meeting links as well.

And, if there’s a good reason to post a meeting link publicly, refer to the information in the “Important Zoom Settings” section below to ensure that you’re maintaining the highest level of security and privacy protection that you can in those circumstances.

2. Protect the purpose and participants

There are many reasons for individuals to meet and many different types of meetings. When you are setting up a Zoom meeting, your meeting purpose and your participant list both have an impact on your security needs. In the following section, you will find a list of the most important Zoom settings to consider when setting up and hosting meetings and recommendations for when to turn them on and off.

Privacy considerations for Zoom cloud recording

There are many aspects associated with the Freedom of Information and Protection of Privacy Act (“FIPPA”) privacy protection requirements, BCIT Policy 6700, Freedom of Information and Protection of Privacy, and use of the Zoom recording feature.

Do not use non-BCIT Zoom accounts for BCIT business purposes.
Inform attendees of your intent to and reason for recording the meeting before you start the recording.
While Zoom has an automated audio notification that the meeting is being recorded it is not enough to meet the BCIT’s legal obligations under FIPPA. Prior to starting recording participants must be verbally informed that their personal information will be captured and will be recorded. This information may also be included in the meeting invite. Hosts should advise attendees that they have the options of leaving the meeting, changing their name, and /or turning of their own video.
Know that all recorded Zoom content may be subject to a formal FOI request under FIPPA.

Additional resources

If you are intending to record your meeting or webinar using Zoom, consider these points:

Think about whether you need to record your meeting. Some may prefer to record meetings in case individuals are unable to participate while others may choose to record in lieu of having someone take minutes for the meeting, so any information discussed can be referred to in the future. Information meetings may also be helpful in building a database of knowledge and education.

Even though it may be convenient and you can record a conversation/meeting in which you are involved, there are a number of consequences, such as confidentiality or privacy (e.g., 1:1 meetings with employees, labour relations discussions or investigations, meetings that refer to an individual’s medical information, etc.), and legal obligations to consider in order to protect yourself and the other participant(s), such as obtaining informed consent in a group context from those who are not directly participating in the discussion/meeting being recorded and individuals’ access and privacy rights under FIPPA.

If you believe there has been an inappropriate recording, contact the Information Access and Privacy Office (IAPO) at privacy@bcit.ca.

Students in Zoom-delivered classes, seminars, labs and other student meetings should not be routinely recorded. There is a real possibility that a student’s personal information (e.g., name, image, voice, personal views and opinions, course work) may be inadvertently captured in a recording. If you are recording teaching then refer to the BCIT’s policy 5201 – Recording in the Classroom and 5201-PR1, Recording in the Classroom.

Recording meetings for research use, especially in the context of health research, will require ethics clearance and documented consent from participants. All enquiries about research-related policies and their application should be addressed to the Applied Research Liaison Office (ARLO).

Note that some students registered through Accessibility Services may have permission to individually record lectures as per BCIT Policy 4501 – Accommodation for Students with Disabilities. Further advice on classroom accommodations for students can be sought by contacting Accessibility Services at accessibility@bcit.ca.

If you are recording a meeting, then ensure everyone has been informed and explain the reason a recording is being made. Note that any contributions that participants make, including any chat comments, will be part of that record.

While Zoom has a notification that the meeting is being recorded it is not enough to meet the BCIT’s legal obligations under BC’s Freedom of Information and Protection of Privacy Act (FIPPA). Participants must be verbally informed that a Zoom class, seminar, lab or meeting in which their personal information will be captured will be recorded. In order for a participant to provide informed consent, they must be advised as to:

The purpose for making the recording (why the recording is being made);
The intended use / disclosure of the recording (any additional uses/who will have access to the recording and how it will be disseminated); and
How, and for how long it will be retained (how long access will be provided and when the recordings will be destroyed or otherwise deleted).

In the case of teaching, Instructors should announce that a recording is being made at the beginning of each recorded session, and also include language in their course syllabus and/or outline about the purpose of Zoom recordings. Note that consent can be considered explicit or implied; explicit consent requires the participants to express their consent to be recorded whereas implied consent assumes the participant is consenting to the recording if there is an overt indication that the meeting is being recorded.

Support for creating the appropriate privacy notice can be sought by contacting IAPO at: privacy@bcit.ca.

Important Zoom meeting settings

Where to find it:	In your personal settings – Settings > Schedule Meeting When creating a Zoom meeting through Outlook, under Advanced Options
Default:	Off, can be turned on
Leaving this off is recommended for:	Online classes w/ group s or classes of students. Info sessions / other presentations to the public. Hiring interviews. Any situation in which there is a greater likelihood of the meeting link becoming accessible to unknown persons.
Turning this on is recommended for:	One-off or recurring small group / department meetings with only other BCIT faculty & staff as participants. If the host has assigned a colleague as a co-host (see below), that person has almost as many abilities as the host would and can run/moderate the meeting if the host is running late or cannot attend.
Zoom Help Centre:	Join before host

Where to find it:	In your personal settings – Settings > In Meeting (basic) When creating a Zoom meeting through Outlook, Advanced Options > Alternative hosts
Default:	Off, can be turned on. Has no effect unless the host also chooses to add a co-host
Turning this on and adding a co-host is recommended for:	Meetings which the host may need to miss or attend only partially. Recurring small group / department meetings. Meetings with a large number of participants where the need for increased participant support, monitoring, or moderation is likely.
Leaving this off/not adding a co-host is recommended for:	Any situation in which the co-host is not known to the host.
Zoom Help Centre:	Enabling and Adding a Co-host Host and Co-Host Controls in a Meeting

Default:	“All Participants”, can be changed to “Host Only”
Leaving this as “All participants” is recommended for:	Most collaborative meetings between colleagues. Online classes w/ groups or classes of students in which students are expected to present or share their screens with each other.
Changing this to “Host Only” is recommended for:	Most online classes w/ groups or classes of students. Info sessions / other presentations to the public. Any situation in which there is a greater likelihood of the meeting link becoming accessible to unknown persons.

Screen Sharing > Who can share?

Default:	“All Participants”, can be changed to “Host Only”
Leaving this as “All participants” is recommended for:	Most collaborative meetings between colleagues. Online classes w/ groups or classes of students in which students are expected to present or share their screens with each other.
Changing this to “Host Only” is recommended for:	Most online classes w/ groups or classes of students. Info sessions / other presentations to the public. Any situation in which there is a greater likelihood of the meeting link becoming accessible to unknown persons.

Screen Sharing > Who can start sharing when someone else is sharing?

Default:	“Host Only”, can be changed to “All Participants”
Leaving this as “Host Only” is recommended for:	Online classes w/ groups or classes of students in which students are expected to present or share their screens with each other. Most meetings / events with more than one participant in addition to the host.
Changing this to “All Participants” is recommended for:	Collaborative one-to-one or small group/department meetings in which attendees are well-known to each other and understand the etiquette of using the technology.

Where to find it:	In your personal settings – Settings > Schedule Meeting
Default:	Off, can be turned on.
Leaving this off is recommended for:	Situations in which the likeliest reason for a host to remove participants is for moderation purposes, such as events which are accessible to the general public and to which the invite is widely distributed.
Turning this on is recommended for:	Situations in which the likeliest reason for a host to remove participants is to assist with technical difficulties, such as small group / department meetings.
Zoom Help Centre:	Managing Participants in a Meeting Allowing Removed Participants to Rejoin

Mute participants upon join

Where to find it:	In your personal settings – Settings > Schedule Meeting (Basic) When creating a Zoom meeting through Outlook, under Advanced Options.
Default:	Off, can be turned on. Impact is different depending on whether participants are permitted to unmute themselves (below).

Allow participants to unmute themselves

Where to find it:	In your active meeting’s controls – Manage Participants > More
Default:	On, can be turned off.
Leaving this on is recommended for:	Most collaborative meetings between colleagues. Online classes with smaller numbers of students that are intended to be interactive or conversational.
Turning this off is recommended for:	Meetings/online classes with larger numbers of participants that are primarily presentational. Info sessions / other presentations to the public. Any situation in which there is a greater likelihood of the meeting link becoming accessible to unknown persons.
Zoom Help Centre:	Managing Participants in a Meeting Mute All and Unmute All

Where to find it:	In your personal settings – Settings > In Meeting (Advanced)
Default:	Off, can be turned on.
Leaving this off is recommended for:	Most meetings with colleagues. Online classes with students. Larger public events where participant permissions – such as the ability to unmute or share screens – will already be locked down.
Turning this on is recommended for:	Meetings with a high need for confidentiality/ privacy or in which very sensitive information will be discussed or shared. Selection Interviews. Meetings in which one or more participants have been invited to join for a shorter section of the sensitive meeting.
Zoom Help Centre:	Waiting Room

Where to find it:	In your personal settings – Settings > Schedule Meeting
Default:	On, and cannot be turned off.
Zoom Help Centre:	Meeting Passwords

Important Zoom cloud recording settings

Where to find it:	In your personal settings – Settings > Recordings
Default:	On, and cannot be turned off. Important: This setting turns on the ability to share recordings. It does not share recordings by default. Your cloud recordings are still, by default, only accessible by you, unless you decide to share each one individually.
Zoom Help Centre:	Managing and sharing cloud recordings

Where to find it:	In your personal settings – Settings > Recording
Default:	Off, can be turned on. Important: Anyone with a Zoom account, including non-BCIT accounts, is considered to be authenticated when they’re logged into their account. Turning this setting On won’t limit access to only those with a BCIT zoom account, for example.
Zoom Help Centre:	Enabling authentication to view cloud recordings

Where to find it:	In your personal settings – Settings > Recordings
Default:	On, and cannot be turned off. You can modify a recording’s automatically generated passcode, which will make it inaccessible to anyone with the previous passcode.
Zoom Help Centre:	Settings for sharing cloud recordings

Where to find it:	In your personal settings – Settings > Recordings
Default:	On, and cannot be turned off, set to 120 days. Cloud recordings are only saved for 120 days. If you wish to keep a recording for longer than that, you can download it to your computer.
Zoom Help Centre:	Managing and sharing cloud recordings

Zoom resources

The resources below are available from the vendor:

Zoom’s free interactive live training webinars
Zoom Video Tutorials
Zoom Help Center – Zoom’s user documentation. Useful categories:

Zoom Privacy & Security Guidelines at BCIT (November 2022)

Zoom cloud recording

Tips for all Zoom meeting users

1. Protect meeting links

2. Protect BCIT private information

3. Protect the privacy of the people around you

Tips for meeting hosts & organizers

1. Protect meeting links

2. Protect the purpose and participants

Privacy considerations for Zoom cloud recording

Additional resources

Do you need to record your meeting?

Do you need to tell attendees that you're recording the meeting?

Do you need audio and video, or just audio?

Important Zoom meeting settings

Enable join before host

Co-host

Screen sharing

Screen Sharing > Who can share?

Screen Sharing > Who can start sharing when someone else is sharing?

Allow removed participants to rejoin

Muting participants

Mute participants upon join

Allow participants to unmute themselves

Waiting room / Enable waiting room

Require password for... meeting

Important Zoom cloud recording settings

Allow cloud recording sharing

Require users to authenticate before viewing cloud recordings

Require passcode to access shared cloud recordings

Viewers can see the chat (in a recorded meeting)

Delete cloud recordings after a specified number of days

Zoom resources