Privacy governance not included: analysis of third parties in learning management systems

Abstract

Purpose This paper aims to address research gaps around third party data flows in education by investigating governance practices in higher education with respect to learning management system (LMS) ecosystems. The authors answer the following research questions: how are LMS and plugins/learning tools interoperability (LTI) governed at higher education institutions? Who is responsible for data governance activities around LMS? What is the current state of governance over LMS? What is the current state of governance over LMS plugins, LTI, etc.? What governance issues are unresolved in this domain? How are issues of privacy and governance regarding LMS and plugins/LTIs documented or communicated to the public and/or community members? Design/methodology/approach This study involved three components: (1) An online questionnaire about LMS, plugin and LTI governance practices from information technology professionals at seven universities in the USA (n = 4) and Canada (n = 3). The responses from these individuals helped us frame and design the interview schedule. (2) A review of public data from 112 universities about LMS plugin and LTI governance. Eighteen of these universities provide additional documentation, which we analyze in further depth. (3) A series of extensive interviews with 25 university data governance officers with responsibilities for LMS, plugin and/or LTI governance, representing 14 different universities. Findings The results indicate a portrait of fragmented and unobtrusive, unnoticed student information flows to third parties. From coordination problems on individual college campuses to disparate distributions of authority across campuses, as well as from significant data collection via individual LTIs to a shared problem of scope across many LTIs, the authors see that increased and intentional governance is needed to improve the state of student privacy and provide transparency in the complex environment around LMSs. Yet, the authors also see that there are logical paths forward based on successful governance and leveraging existing collaborative networks among data governance professionals in higher education. Originality/value Substantial prior work has examined issues of privacy in the education context, although little research has directly examined higher education institutions’ governance practices of LMS, plugin and LTI ecosystems. The tight integration of first and third-party tools in this ecosystem raises concerns that student data may be accessed and shared without sufficient transparency or oversight and in violation of established education privacy norms. However, these technologies and the university governance practices that could check inappropriate data handling remain under-scrutinized. This paper addresses this gap by investigating the governance practices of higher education institutions with respect to LMS ecosystems.

Guest editorial: The datafication of student life in higher education: privacy problems and paths forward

“…Other findings suggest elements that could improve the trustworthiness of learning analytics practices. Sanfilippo et al (2023) "Privacy governance not included: analysis of third parties in learning management systems", Information and Learning Sciences, doi: 10.1108/ILS-04-2023-0033:…”

“…Learning management systems (LMSs), and the third-party plug-ins and learning tools interoperabilities (LTIs) embedded within, have become commonplace educational technologies in higher education. However, Sanfilippo et al (2023) note how these tools and the reliance thereon by instructors and students "was amplified throughout the COVID-19 pandemic, as digital solutionism paved the way for virtual classrooms and digital proctoring via synchronous and asynchronous means of collaboration between students and instructors." The problem for student privacy is that, they write, "higher education institutions have access to, and in many cases locally host, substantial amounts of student data on LMS[s] that provide third-party mechanisms to enhance interfaces, add new functionalities, and customize user experiences for specific institutions, departments, or courses.…”

“…Sanfilippo et al (2023) “Privacy governance not included: analysis of third parties in learning management systems”, Information and Learning Sciences , doi: 10.1108/ILS-04-2023-0033:…”

“…However, Sanfilippo et al (2023) note how these tools and the reliance thereon by instructors and students “was amplified throughout the COVID-19 pandemic, as digital solutionism paved the way for virtual classrooms and digital proctoring via synchronous and asynchronous means of collaboration between students and instructors.” The problem for student privacy is that, they write, “higher education institutions have access to, and in many cases locally host, substantial amounts of student data on LMS[ s ] that provide third-party mechanisms to enhance interfaces, add new functionalities, and customize user experiences for specific institutions, departments, or courses. The tight integration of first and third-party tools in this ecosystem raises concerns that student data may be accessed and shared without sufficient transparency or oversight.” To address governance issues associated with LMSs and LTIs, Sanfilippo et al (2023) conducted a multimodal study consisting of an online questionnaire collected from information technology professionals at seven universities in the USA and Canada, in-depth interviews with 25 data governance professionals and decision-makers at 14 US research universities, and documentation from 112 universities regarding LMS, plugin and LTI usage and management. Using the Governing Knowledge Commons framework in support of their analysis, Sanfilippo et al (2023) found few legal protections for students concerning third-party data flows, mostly failures of governance at the institutional level (with a few notable exceptions), and opaque decision-making processes.…”

“…The tight integration of first and third-party tools in this ecosystem raises concerns that student data may be accessed and shared without sufficient transparency or oversight.” To address governance issues associated with LMSs and LTIs, Sanfilippo et al (2023) conducted a multimodal study consisting of an online questionnaire collected from information technology professionals at seven universities in the USA and Canada, in-depth interviews with 25 data governance professionals and decision-makers at 14 US research universities, and documentation from 112 universities regarding LMS, plugin and LTI usage and management. Using the Governing Knowledge Commons framework in support of their analysis, Sanfilippo et al (2023) found few legal protections for students concerning third-party data flows, mostly failures of governance at the institutional level (with a few notable exceptions), and opaque decision-making processes. They argue that “that student privacy is being overlooked, ignored, and, in some cases, intentionally sacrificed [….]…”