Canvas

The roll out of the "Online Learning Environment" (OLE) and the following migration of Master's and Bachelor's courses to the new learning and teaching management system (LMS) "Canvas" makes progress. A number of Master's programs moved to Canvas for the winter term 2022/23, with more to follow this summer term. The bulk of Bachelor's courses are scheduled for the winter term 2023/24. This raises questions for more and more WU employees involved in teaching about time perspective, concrete recommendations for Canvas usage, and planning the actual work of migrating from LEARN to Canvas. At the same time, the Academic Staff Council has been receiving a growing number of inquiries regarding data protection, privacy, protection of exploitation rights. This documents that, currently, WU’s accompanying support and communication activities do not sufficiently cover these issues (e.g.: Canvas training courses or "Townhall: Transforming Tomorrow").

In last year’s BRInfo issue 4/2022, a number of recommendations on using Canvas were presented, based on the state of knowledge at the time and based on the responses to our requests for clarification received from WU. Since then, we have sought further dialogue with our colleagues from "IT-Services" (IT-S) and "Digital Teaching Services" (DTS) at the bi-monthly "IT Jour Fixe" and several dedicated meetings. We were assured that many organisational and technical fixes and improvements have been initiated by WU. We would like to emphasize at this point that the responsible service units are actively working on the problem areas and keep communicating with us in a transparent manner. However, it is troubling that despite the advanced stage of the OLE project (operations started in July 2022, after six months of testing) and the ongoing operation, important steps have not been completed or do not yet have a completion date, due to the dependencies on external service providers.

Therefore, our recommended actions and guidance on "Canvas" remain unchanged. However, we can provide one important clarification regarding the "obligation” to use “Canvas":

• Alternatives to Canvas: The Vice-Rectorate for Academic Programs and Student Affairs has made it clear to us that using "Canvas" in and for your teaching is desired, centrally organized, and fully supported by WU’s service units, but that there is by no means a strict obligation to use "Canvas". Faculty members can organize their "teaching management" on their own responsibility and in alignment with the respective program directors. This might be the case, for example, if you have strong reservations about Canvas or Canvas cannot meet special requirements of your teaching. However, the major limitation is that individual or program-specific solutions are not supported by WU’s service units. As a staff council, we would also like to underline that any alternative solution to Canvas should only be re-using and building on existing operational resources (in German: “Betriebsmittel”) that the employer provides centrally or decentrally (e.g. ownCloud, BACH, Email infrastructure, GitLab, LEARN).

• Terms of Use: The currently applicable terms of use have not been revised since the start of Canvas’ live operations and are unfortunately outdated. WU was unable to tell us when updated terms of use will be available and technically integrated. Important questions are also still open: How will it be implemented (technically, organizationally) that the consent of employees to the changed terms of use must be obtained again? What happens to the data in Canvas if employees do not accept the changed terms of use? Etc. We do not know to what extent the revised terms of use will include the recommendations presented to us (see below).

• Lack of access control to files: Content uploaded to Canvas by teachers is currently accessible via temporary URLs for a period of 24 hours, and content uploaded by students is accessible freely (without permission) and without access control for a period of 10 hours, provided the temporary URL is known. This problem has not been addressed to date. The service provider "Instructure Global Ltd" communicated to WU the possibility of a technical solution by Q4 2023. WU has assured us that they are working towards a solution by Q2 this year. Therefore, until this situation will be resolved technically, we strongly recommend that you only store and share files via Canvas with extra measures in place (e.g., password-protected files, sharing materials via temporary and password-protected ownCloud links). This is especially important for materials that are subjected to exploitation rights by third parties (e.g., publishers), or that may touch upon spheres deserving protection (such as video recordings from private or personal office spaces). This is mainly because Canvas fails to deliver the level of access control that we are used from LEARN as an LMS.

• Use of Canvas only on top of VPN: We recommend using Canvas only from a location within the WU network (at the computer workstation or "eduroam" on campus) or via a VPN connection to the WU network. This includes, but is not limited to working while abroad. The background is that Canvas distributes application data and content globally (Amazon Cloudfare as a so-called "Content Distribution Network", CDN) and delivers this data dependent on the client’s location possibly from data centers from outside a secure third country (outside the EEA). We would like to underline that WU recommends the use of various WU services primarily via VPN; in the case of Canvas, this is even required. Currently, WU is working on reorganizing WU’s VPN infrastructure to ensure the quality of service.

• Canvas mobile apps (esp.: "Canvas for Teachers"): WU advises against using the mobile apps available for Canvas for Android- or iOS-based smartphones, among others. Although the service provider "Instructure Global Ltd" confirmed the basic GDPR compliance, employee support is very important for WU, and providing this support is not possible given the variety of mobile-device types. There is no support from WU for these apps. From our point of view, these apps are very questionable in terms of data protection, even if there was GPDR compliance as a minimum prerequisite.

• Data Retention with "Canvas Commons": Beware that when you use "Canvas Commons" you are also automatically opting in to have your content (course materials) stored and held outside of a safe third country (outside of the EEA). Therefore, it is advised to provide additional confidentiality protection for your data when voluntarily using “Canvas Commons” (e.g. password-protected files or sharing materials via time-limited and password-secured ownCloud links).

Zoom

With respect to Zoom, the employer has informed us that WU has implemented additional privacy-friendly defaults for Zoom use, effective immediately. In doing so, it is following known recommendations and agreed to continuously evaluate whether improvements are possible (for example, when the new teaching formats take hold with the coming winter semester). Each individual can make additional settings, which are listed in the WU Media Guide for Zoom under "How can I protect my data? We strongly recommend enabling these settings (especially end-to-end encryption). This is particularly warranted when it is already foreseeable that features such as breakout rooms and recording Zoom sessions are not needed.

Together with our colleagues from the service units, we continue to tackle these issues (Canvas, Zoom) and will provide updated information via BRInfo or upon request to wiss.betriebsrat@wu.ac.at. In addition, we would like to point out the extensive training offers on the new systems that are offered to employees through WU's education program.

Specific questions regarding the above recommended actions (but also your underlying concerns regarding data protection, privacy, exploitation rights, etc.) can also be addressed directly to the employer via the WU ServiceDesk, which is very important!

^09.03.2023

back to the top