Collecting Personally Identifiable Information (PII) on UBC CMS

Who? Administrators of websites hosted on UBC CMS that use Gravity Forms.

What? Collection of PII is not covered in our scope of service and is prohibited on UBC CMS. PII includes, but is not limited to, Social Insurance Numbers (SIN), Passport Data, University Transcripts, Medical Records, and Student Numbers.

When? This has been the case for several years. Action is possibly required immediately.

Action Required? If any of your website’s forms are collecting any PII, please edit the form to stop doing so ASAP. UBC IT has approved Qualtrics as the BC FIPPA-compliant tool to collect sensitive data.

If you are a site administrator that uses the forms capability within UBC CMS (known as the Gravity Forms plugin) then it’s important to understand what sort of information you can, and more importantly, what you should not collect from your visitors.

Gravity Forms is a full-featured, and very powerful forms creation tool. It allows you to collect data in various formats, including the uploading of files, text input, checkboxes, radio buttons etc. As usual, with great power comes great responsibility and it is your responsibility, as website owners and administrators, to ensure that the data you are collecting is allowed to be collected on UBC CMS.

Our scope of service, alongside our terms of service, which you agree to abide by when using UBC CMS, requires of you to not collect any data that is considered Personally Identifiable Information. We encourage everyone who creates forms – on CMS or otherwise – to take the free UBC IT provided Fundamentals Training.

A useful general rule of thumb before creating a web form is to ask “what is the absolute minimum information we need from a user?” with a follow-up of “and how is that data going to be stored?”. Asking for the minimum helps reduce your risk profile with the data you collect. Knowing how and where the data is stored helps you understand – and therefore begin to mitigate – any issues you may face with regards to data security. Gravity Forms stores data in the UBC CMS database and files on the UBC CMS servers. Also optionally, and by default, it can send one or more emails to people associated with the form with the data submitted by somebody.

If you include a file upload field in your form, when someone submits that form, and uploads a file, that file will have a publicly accessible URL. the URL will be obfuscated — difficult to guess — but if someone does have the URL, they will be able to see the file without needing to authenticate anywhere. File uploads are, will continue to be, and always have been, public.

Please take a look at the forms you have on your website. You can do so by signing in to the dashboard of your site and clicking on the ‘Forms’ menu on the left hand side. If you don’t see a Forms menu, either you are not using Gravity Forms on your site, or you are not an administrator on that site.

If you have any questions regarding forms, data collection, PII, our terms of service, or this post, please reach out to us at