Naked in the Garden: Privacy and the Next Generation Digital Learning Environment

It's lunchtime, and the campus is bustling with activity. To reach a noon-hour meeting about using social media for instruction, I skirt a eucalyptus grove, a stand of redwoods along a creek, and a wide variety of blossoming trees, drought-tolerant landscapes, and manicured lawns between modern glass, historic brick, and classic stone buildings. The variety of settings on our physical campus —reflecting and stimulating the community’s diversity of inspirations and collaborations — is mirrored in our virtual learning environment: a dynamic and complex amalgamation of rapidly evolving educational technology and consumer applications.

The meeting was prompted by recognition that faculty frequently reach for tools beyond those offered in the campus-licensed learning management system (LMS) in order to engage students with their favorite consumer apps. In response, an academic senate committee seeks to publish guidance for evaluating use of social media assignments in course proposals. Our small group offers considerations on issues ranging from device availability and support for assistive technology, to privacy, long-term data control, ownership, and curation.

In my next meeting across campus, I spend an hour and a half in conversation with a data analyst about how privacy and online monitoring issues relate to institutional research. We discuss the Institutional Review Board (IRB) and Federal Education Rights and Privacy Act (FERPA) regulatory obligations associated with research involving student data¹ and how studies conducted on behalf of the institution fall into a special niche between those protections. We contemplate the many disparate data points we collect on students and envision the benefits of correlating and analyzing more information to evaluate, quantify, and improve their experience. We also ruminate over the impact of pervasive monitoring in a creative learning environment where individuals need space to experiment without intimidation and freedom to take risks without fearing the consequence of closing doors.

These two sequential conversations portend the future of educational technology. Phil Hill describes today's learning management system as a "walled garden" where user-created content and transactional data stay protected inside an institutionally curated landscape. This contrasts to the future's next generation digital learning environment (NGDLE), which he describes as an "open garden" where data freely traverses disparately sourced applications. When the online campus ecosystem is assembled by instructors and learners into personalized learning tool mash-ups, where metrics-oriented data standards enable us to measure, correlate, and analyze every point of interaction, how do we safeguard privacy so we don't leave students and other users overly exposed in our virtual open garden?

Privacy Interoperability Standards

Privacy impact assessments (PIAs) are the standard measuring tape in a privacy officer's toolkit for evaluating a potential system's privacy risks. The E-Government Act of 2002 requires PIAs before collecting personally identifiable information or developing or purchasing federal systems that handle personal information. The PIA outlines a systematic process of defining the scope and purpose of information collection, appraising compliance requirements, and analyzing privacy risks and mitigations.² While PIAs are an accepted convention, formally performing them might be more aspirational than routine in much of higher ed because of resource limitations. Conducting PIAs as part of a centralized vetting process is especially untenable when students and instructors construct their custom learning environments by assembling apps from an uncharted universe of offerings. We need a way to vet privacy practices on the fly.

Interoperability with "unimpeded exchange of data"³ is touted as an imperative for the NGDLE in order to support an ecosystem of diverse components. I recommend a measure of caution. While the ultra-interchangeable Lego system might be ideal for plastic toys, perhaps the electric socket model is more appropriate when student privacy and responsible stewardship of data are at stake. Having once been thrown to the floor of a cottage in Bali when plugging an inappropriate adapter into the wall, I consider effort spent finding the correct three-prong plug to be worth any sacrifice of convenience. Standard two-prong plugs may be acceptable for maximum interoperability in low-risk scenarios, but due diligence calls for grounding data exchanges in approved privacy practices.

Institutions have different cultures and hold different norms around responsible data use. The 2016 Asilomar II Convening on responsible use of student data proposed creating a "template or broad set of principles which can be expanded to include institutionally-specific context/priorities." This concept could be realized in the form of an NGDLE Privacy Interoperability Standard. Institutions that prioritize interoperability and have minimal privacy restrictions might accept a generic template, like a world-traveler's adapter plug that accepts any-shaped prongs. Other institutions with more rigorous privacy expectations could require assertion of a specific privacy standard in the interoperability handshake.

The IMS Global Privacy and Security Task Force has already laid out a model for a Data Use Label,⁴ like a nutrition label, to be displayed to the system administrator at the time of tool registration with the Learning Tools Interoperability (LTI) standard. Enhancing this type of handshake to perform automated vetting based on institutionally defined settings for a broader set of privacy standards would create a path for effective privacy management in the distributed next-generation digital learning environment.

What would those privacy standards comprise? Multiple privacy frameworks provide source material for crafting an NGDLE Privacy Interoperability Standard.

Fair Information Practice Principles (FIPPs) and OECD Privacy Principles define core tenets that have served as the foundation for privacy law and policies around the world for many decades.⁵ The Consumer Privacy Bill of Rights, a more recent attempt by the Obama White House to define a privacy framework for the Internet age, recognizes that we share personal information more freely than in the past. Several frameworks have emerged in recent years focused specifically on the learning data context. The NISTIR 8062 Privacy Engineering Objectives⁶ attempt to bridge the gap between high-level privacy principles and their implementation within systems by identifying categories of system capabilities needed to implement privacy policies.

As a crosswalk between the various elements in each privacy framework, table 1 categorizes related concepts from these distinct schemes into five broad themes. These themes offer the basis for an NGDLE Privacy Interoperability Standard. Some privacy concepts are consistent across the schemes, though the frameworks differ in labeling, emphasis, goal, and approach to each concept. One framework may express multiple ideas within a given theme, or may address the theme's basic concept as part of a different theme, or may not touch that theme at all. The sections following the table provide a high-level guided tour through the crosswalk.

Table 1. Crosswalk of digital learning environment privacy principles

 

I. Degree of Transparency and Predictability

How specific is notice regarding the purpose of data collection and how predictable (based on collection context) are data uses?

Transparency is a theme found across privacy schemes, but the expected degree of specificity in the disclosure about data use varies by scheme. Traditional methods of providing transparency involve giving notice regarding purpose of collection, offering the data subject the choice about whether or not to participate, and limiting collection and use to that specified purpose. Since the rise of data analytics — where the next significant correlation between disparate data points is yet to be discovered, and research funding requirements often stipulate data sharing — "purpose specification" is notably missing from newer privacy frameworks.

One alternative approach suggests shifting the focus away from the data collector's responsibility to provide notice of specific uses so the data subject can make informed choices about participation, toward the data processor's responsibility to make contextually appropriate decisions about use of the data. The Consumer Privacy Bill of Rights, for example, calls for "Respect for Context," meaning data should only be used in a manner that is consistent with the original data collection, or if different, only with heightened transparency and individual choice regarding participation. Proponents of this approach cite the difficulty of predicting future data uses plus the fact that few data subjects read the notice anyway. Others remain skeptical of relying on data processors to keep the best interests of data subjects in mind when determining "appropriate" data uses, and call for just-in-time notices to alert users regarding data collection and use. The NIST framework leads system designers to identify the desired approach (notice and choice, respect for context, or otherwise) to meeting the system's predictability goals so that stakeholders are not surprised by data handling, even when contexts change.

II. Degree of Anonymity or Choice

To what degree is data anonymized or is the individual given a choice regarding participation?

As already mentioned, the concept of choice is frequently tied to the concept of notice. Like the spectrum of approaches available within the transparency theme, the extent of an individual's ability to choose whether to participate in data collection and allow use of their data also spans a range of possibilities. When data uses are not predictable and consistent with the context in which the data was collected, it is ideal to give subjects the choice whether or not to participate. Institutional and application-specific values and context will dictate the level of control an individual has over the use of their data. For example, does the institution allow students to opt out of research conducted using student learning data?

Techniques for de-identifying data play a key role in this arena. For some uses, e.g., for research studies, we can disassociate data from personal identities, while in other cases data must remain identifiable, e.g., to provide actionable information to a student or advisor. Some data may need to move back and forth between anonymized and identifiable states, e.g., anonymous grading of law school exams to prevent bias and to protect students with disability accommodations from stigma. A NGDLE Privacy Interoperability Standard is needed to specify the parameters for institutional, application, and individual requirements and preferences regarding choice, and these specifications need to be embedded and transferred together as attributes of the data.

III. Degree of Access, Ownership, and Control

What level of individual, institutional, vendor, and public access to and ownership of data is defined?

Access, as originally described in privacy frameworks, focused on the rights of data subjects to be engaged in the data collection process and to have access to their own data in an understandable format where they can ensure the accuracy of data affecting them. With the increasing complexity of data algorithms, machine learning decision support, and predictive analytics, these goals have renewed importance. The European Union's General Data Protection Regulation (GDPR) requires that data processors provide information to data subjects about the existence of automated decision making with meaningful information about the logic involved and the significance and consequences of such processing. The broad scope of GDPR is expected to impact institutions world-wide. When new information is produced through algorithms that are difficult to understand with human logic, explanations highlighting factors most important to the algorithmic model need to be embedded with the data as it is exchanged through the NGDLE.

A new facet of access and ownership arises in the NGDLE stemming from dependence on external providers and the need to protect the interests of higher ed institutions. Embedding data ownership arrangements within the interoperability handshake between any plug-and-play system is needed to ensure educational institutions maintain their access to the learning data that is core to the educational mission.

The NGDLE Privacy Interoperability Standard needs robust assignment of student, instructor, and institutional data-sharing rights in order to support multi-institution collaborations, data sharing for public-funded research, and competency-based course credit models where students retain evidence of their learning throughout their academic careers and professional lives. The NGDLE must support the ability for student work to move back and forth between private experimental spaces, limited collaboration modes, and public exchange of ideas according to granular definitions of intellectual property rights.

IV. Accountability for Ethical Use, Stewardship, and Governance

What ethical guideposts and accountability measures are demonstrated by entities handling student data?

Privacy is just one aspect of ethical use of learning data. An application's benefit to pedagogy and instruction, such as its ability to strengthen the student-instructor relationship, supports their success and enables opportunity for all learners without foreclosing futures, balancing the risks that come with sharing learning data. An application provider's attestation or demonstration of adherence to governance processes and ongoing accountability to ethical principles extends the level of trust between entities and thus allows the exchange of more sensitive data.

V. Security and Technical Standards

Privacy standards that govern what is deemed appropriate for authorized uses of personal data are supported by security standards that protect systems and data from unauthorized use. Authentication, authorization, and encryption specifications are important security mechanisms for safeguarding data. The Caliper and xAPI open standards address technical and security standards to some extent, and the robustness of the security model is key to the strength of the NGDLE Privacy Interoperability Standard.

Baselines and Extensions

Like urban planners laying out utilities and grids for a new city, architects of the NGDLE Privacy Interoperability Standard can define baseline specifications and optional extensions on these five privacy themes:

1. Degree of Transparency and Predictability
2. Degree of Anonymity or Choice
3. Degree of Access, Ownership and Control
4. Accountability for Ethical Use, Stewardship and Governance
5. Security and Technical Standards

For example, the minimum assertion for the NGDLE Privacy Interoperability Standard I: Transparency and Predictability could be "Data collected will be used or disclosed primarily for purposes consistent with pedagogy and student success. Data subjects will have the ability to opt-out of participation in any data use unrelated to pedagogy and student success." Optional extensions might be, for example: (a) general information about data collection, retention, use, and sharing practices will be made available to all users in the form of a published privacy statement; (b) data uses unrelated to pedagogy and student success are only allowed if active (opt-in) consent is first obtained; and (c) just-in-time notice of data access and use will be provided to users.

Before allowing any exchange of data, applications and institutions can assess their mutual privacy compatibility on-the-fly by comparing each other's claims of compliance with established standards for each privacy theme. Institution A may not feel any Transparency and Predictability assertions are necessary and accept all plug-ins indiscriminately; Institution B might deem the baseline and any extension acceptable; and Institution C might only accept application plug-ins that conform to standards I(b), opt-in for secondary use, and I(c), just-in-time notice.

Enterprising institutions and students would take on the work of verifying the compliance assertions of applications. Standards bodies would take the role of collecting and publishing black, white, and grey lists of applications whose assertions have been verified as compliant or not compliant, and this, too, could factor into an institution's privacy requirements based on their risk tolerance. This low-overhead model allows institutions to engage in the NGDLE ecosystem regardless of where they stand on the spectrum between stringent privacy requirements and "unimpeded exchange of data."

Tending the Garden

Whether an institution's NGDLE looks more like a meticulously designed garden bed, a patchwork of community plots, or a field of native flowers and grasses, designing privacy requirements into data interoperability standards gives us tools to ensure that practices around transparency, choice, ownership, governance, and security align with institutional and personal privacy values.

By defining NGDLE Privacy Interoperability Standards, we elevate our stewardship of learning data to more fully support the next generation of students as they cultivate their digital learning environments.

Acknowledgment

I would like to thank Jenn Stringer of the University of California, Berkeley, for her contributions to this article.

Notes

1. Federal regulations (Common Rule 45 CFR 46) require IRB approval of research involving humans. Separately, FERPA provides exemptions from the requirement to obtain individual consent for use of student data in studies conducted for or on behalf of the school to improve instruction.
2. Department of Homeland Security, "Privacy Impact Assessment Guidance," published June 2010; template available as of 2017.
3. Malcolm Brown, Joanne Dehoney, and Nancy Millichap, "Next Generation Digital Learning Environment: A Report on Research," EDUCAUSE Learning Initiative, April 2015, 4.
4. Improving Privacy for Humans and Robots," slides for Learning Impact Leadership Institute, IMS Global Learning Consortium, May 18, 2017.
5. FIPPs [https://a130.cio.gov/appendix1/]: 1973 Federal Government report from the Department of Health, Education, and Welfare Advisory Committee, "Records, Computers, and the Rights of Citizens"; OECD: Organisation for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data adopted in 1980.
6. Sean Brooks, Michael Garcia, Naomi Lefkovitz, Suzanne Lightman, and Ellen Nadeau," NISTIR 8062: An Introduction to Privacy Engineering and Risk Management in Federal Systems," Information Technology Laboratory, U.S. Department of Commerce and National Institute of Standards and Technology, January 2017.

---

Lisa Ho is campus privacy officer at the University of California, Berkeley.